CVE-2026-64604

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. This vulnerability involves how KVM handles virtual machine control structures (VMCS) during certain operations within a virtual machine. An attacker with local access to a virtual machine could exploit this flaw to trigger a system warning, potentially causing the host system to become unstable or unavailable, leading to a denial of service (DoS).

This flaw is rated as Moderate severity because exploitation is restricted to local access to the virtualization subsystem and triggers a kernel warning that may result in host instability or denial of service, without granting arbitrary code execution or compromising host confidentiality. On Red Hat Enterprise Linux systems, the vulnerability only affects hosts utilizing Intel VMX hardware virtualization where users have direct access to the KVM interface. In standard deployments, access to the virtualization control interfaces is restricted to privileged administrators and virtualization daemons, significantly limiting exposure in multi-tenant environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.