CVE-2026-64106 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits
Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits.
Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's KVM implementation for arm64 architecture, specifically affecting the virtual Generic Interrupt Controller with Interrupt Translation Services component. The issue stems from improper validation of Device Table Entry (DTE) state during the restoration process, creating a potential security risk that could allow malicious userspace processes to manipulate virtual interrupt handling mechanisms.
The technical flaw occurs in the vgic_its_restore_dte() function where the system accepts restored DTEs containing an invalid Size field value that specifies more EventID bits than the virtual ITS can support. While the live MAPD (Memory Attribute Descriptor) path correctly rejects such out-of-range states, this particular code path fails to perform the same validation check, allowing corrupted data to persist in the dev->num_eventid_bits variable. This inconsistency creates a dangerous condition where invalid interrupt configuration parameters can be stored and subsequently processed.
The operational impact of this vulnerability extends beyond simple misconfiguration as it enables potential privilege escalation or denial-of-service conditions through carefully crafted malicious state restoration operations. When the unchecked value reaches vgic_its_restore_itt(), the system attempts to convert this oversized EventID bit specification into a scan_its_table() range, potentially causing buffer overflows, memory corruption, or unauthorized access to interrupt handling resources. This represents a clear violation of the principle of least privilege and could allow attackers to manipulate virtual interrupt routing mechanisms.
The mitigation strategy involves implementing the same validation check that exists in the MAPD path, specifically rejecting any restored DTEs where num_eventid_bits exceeds VITS_TYPER_IDBITS before proceeding with device allocation. This defensive programming approach ensures consistency between live and restored state handling, preventing out-of-range values from propagating through the interrupt processing pipeline. The solution directly addresses the root cause by enforcing proper bounds checking at the earliest possible point in the restoration sequence, thereby protecting against potential exploitation scenarios.
This vulnerability aligns with CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories, representing a classic case of insufficient validation of input data within virtualization contexts. From an ATT&CK perspective, this issue could enable techniques such as privilege escalation through hypervisor manipulation or denial of service via resource exhaustion attacks. The fix implements proper state validation that prevents malicious state restoration from compromising the integrity of the virtual interrupt controller implementation.