CVE-2026-64286

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64286
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64286.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64286
Downstream
Published
2026-07-25T08:49:27.542Z
Modified
2026-07-28T04:02:41.286700225Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Clear __hyprunningvcpu when flushing the pKVM hyp vCPU

flushhypvcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxttovcpu() expects a guest context to have a NULL _hyprunningvcpu, which is only ever set on the host context, so that it resolves the vCPU via containerof(). While this is generally the case, flushhypvcpu() copies the context verbatim and does not enforce this, so a value provided by the host is dereferenced at EL2 (host -> EL2).

Fix by clearing __hyprunningvcpu after the copy.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64286.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
be66e67f175096f283c9d5614c4991fc9e7ed975
Fixed
477145860dba4c30f0b4e36f02f4c5291c1c888b
Fixed
dfaef40d8a1533940fc1af788d70fce07362b4ce
Fixed
6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa
Fixed
d4f4d61715d1061ba83b88196a3605662be30750
Fixed
e8042f6e1d7befb2fb6b10a75918642bcd0acf9a

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64286.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.39
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64286.json"