{"id":"CVE-2026-64106","revision":"849cadd28fd2483ea7049abe8e009fa8","records":[{"revision":"849cadd28fd2483ea7049abe8e009fa8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64106","aliases":[],"title":"KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits\n\nUserspace can restore an ITS Device Table Entry whose Size field encodes\nmore EventID bits than the virtual ITS supports.  The live MAPD path\nrejects that state, but vgic_its_restore_dte() accepts it and stores the\nout-of-range value in dev->num_eventid_bits.\n\nReject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before\nallocating the device.  This mirrors the MAPD check and prevents the\nrestored state from reaching vgic_its_restore_itt(), where the unchecked\nvalue can be converted into an oversized scan_its_table() range.","state":0,"publishedAt":"2026-07-19T15:40:09.344+00:00","modifiedAt":"2026-10-19T20:28:12.062+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/kvm/vgic/vgic-its.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"57a9a117154c93539e33161dd318e6aeb8c04efa\",\n                            \"lessThan\": \"1716b7fea2ead941a0dfac06c4504a3437cdf00d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"57a9a117154c93539e33161dd318e6aeb8c04efa\",\n                            \"lessThan\": \"dab9f93251b2c86a033de6098d0c73afddd55d4a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"57a9a117154c93539e33161dd318e6aeb8c04efa\",\n                            \"lessThan\": \"b94538186a3eae3763b8f96dacd610920a865aa7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"57a9a117154c93539e33161dd318e6aeb8c04efa\",\n                            \"lessThan\": \"0680f511926589206f81f57f76ce131d7741a316\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"57a9a117154c93539e33161dd318e6aeb8c04efa\",\n                            \"lessThan\": \"8bcd15b690a390241179516af1b6ae49ebfd9d95\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"57a9a117154c93539e33161dd318e6aeb8c04efa\",\n                            \"lessThan\": \"9ce754ed8e7ab4e3999767ce1505f85c449ccb07\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/kvm/vgic/vgic-its.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.175\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.142\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.92\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.34\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.11\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","score":9,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d","https://git.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4a","https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7","https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316","https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95","https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64106","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64106","identifiers":["CVE-2026-64106"]},"retained":false,"historicalAffected":[]}],"coverage":[]}