CVE-2026-64287

A flaw was found in the Kernel-based Virtual Machine (KVM) component of the Linux kernel on ARM64 systems. A highly privileged local attacker could exploit a vulnerability where the system fails to properly restrict memory access during a specific virtual machine operation. This could allow the attacker to read or write to sensitive memory areas, potentially leading to privilege escalation, where they gain unauthorized higher access, or cause a system crash (denial of service).

An out-of-bounds access flaw rated IMPORTANT was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 systems, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 and the kernel packages in Red Hat In-Vehicle OS. When flushing the pKVM hypervisor's private vCPU state, flush_hyp_vcpu() copies the host vGIC state verbatim without enforcing that used_lrs stays within the number of implemented list registers, as the vGIC list register save and restore code expects. A highly privileged local attacker on the host could supply a crafted used_lrs value that is used at EL2 to index vgic_lr[] and access the ICH_LR<n>_EL2 registers out of bounds, allowing the attacker to read or write sensitive hypervisor memory, potentially leading to privilege escalation or a system crash (denial of service). Red Hat rated this flaw as IMPORTANT with a CVSS score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the CVE.org score of 8.2, reflecting the high attack complexity and the local privileges required to manipulate the vGIC state. Fixes are being pursued through the affected product streams. Red Hat Enterprise Linux 6 and 7 ELS and the RHEL 9.2 z-stream kernels are not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.