CVEFinder.io

CVE-2026-64286

⚠️ high
🔍 Scan for this CVE
Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxt_to_vcpu() expects a guest context to have a NULL __hyp_running_vcpu, which is only ever set on the host context, so that it resolves the vCPU via container_of(). While this is generally the case, flush_hyp_vcpu() copies the context verbatim and does not enforce this,

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU

flush_hyp_vcpu() copies the host vCPU context into the hyp's private
vCPU on every run. ctxt_to_vcpu() expects a guest context to have a
NULL __hyp_running_vcpu, which is only ever set on the host context, so
that it resolves the vCPU via container_of(). While this is generally
the case, flush_hyp_vcpu() copies the context verbatim and does not
enforce this, so a value provided by the host is dereferenced at EL2
(host -> EL2).

Fix by clearing __hyp_running_vcpu after the copy.

CVSS Score
8.2
High
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-25
First Seen: 2026-07-31
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 79.4% of all 340,405 vulnerabilities in our database.

#69,974
Top 25% most severe
Severity Percentile
Last Modified 2026-07-30
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

📦 Affected Products 0

No affected products information available

🔗 References 5