CVE Explorer

CVE-2026-64106

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:1aab9c882d3764b0e456a7f56054f289deabef49eeb096cb8210344e91a1a1d3

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/arm64/kvm/vgic/vgic-its.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1716b7fea2ead941a0dfac06c4504a3437cdf00d","status":"affected","version":"57a9a117154c93539e33161dd318e6aeb8c04efa","versionType":"git"},{"lessThan":"dab9f93251b2c86a033de6098d0c73afddd55d4a","status":"affected","version":"57a9a117154c93539e33161dd318e6aeb8c04efa","versionType":"git"},{"lessThan":"b94538186a3eae3763b8f96dacd610920a865aa7","status":"affected","version":"57a9a117154c935…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["arch/arm64/kvm/vgic/vgic-its.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.142","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"l…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/metrics/0/cvssV3_1

Source references

6 source assertions

{"url":"https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:46af262d133b19b0ae6e03d800f88413650d5d4f833dd0d927c22c1ce17f39b9 · sha256:d2f6a1aee48ba166… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer