CVE-2026-64286 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
flush_hyp_vcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxt_to_vcpu() expects a guest context to have a NULL __hyp_running_vcpu, which is only ever set on the host context, so that it resolves the vCPU via container_of(). While this is generally the case, flush_hyp_vcpu() copies the context verbatim and does not enforce this, so a value provided by the host is dereferenced at EL2 (host -> EL2).
Fix by clearing __hyp_running_vcpu after the copy.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability exists within the Linux kernel's KVM virtualization implementation specifically for arm64 architectures, where improper handling of virtual cpu context management creates a potential privilege escalation vector. The flaw occurs in the hypervisor's vCPU flushing mechanism that manages the transition between host and guest execution contexts at EL2 (Exception Level 2). The vulnerability stems from a fundamental mismatch in how the __hyp_running_vcpu field is managed during context switching operations, creating an exploitable condition that could allow malicious code to manipulate kernel execution flow.
The technical root cause involves the flush_hyp_vcpu() function which performs a verbatim copy of the host vCPU context into the hypervisor's private vCPU structure during each execution cycle. This copying process fails to properly initialize or clear the __hyp_running_vcpu field, leaving it populated with values from the host context. The ctxt_to_vcpu() function expects this field to be NULL when processing guest contexts, as it uses container_of() macro to resolve valid vCPU structures based on this null condition. However, when host-provided values persist in this field during guest execution, the kernel's context resolution logic can incorrectly dereference these pointers at EL2, potentially leading to unauthorized memory access or privilege escalation.
The operational impact of this vulnerability extends beyond simple privilege escalation as it represents a critical failure in the hypervisor's context isolation mechanisms. Attackers could exploit this condition to manipulate the vCPU state management, potentially gaining elevated privileges within the virtualized environment. The flaw specifically targets the arm64 KVM implementation and affects systems running Linux kernels with KVM virtualization enabled, making it particularly relevant for cloud infrastructure and server environments that rely heavily on virtualization technologies. This vulnerability is classified as a memory corruption issue that could enable attackers to execute arbitrary code at the kernel level.
The fix implemented addresses this by explicitly clearing the __hyp_running_vcpu field after each context copy operation within the flush_hyp_vcpu() function, ensuring that guest contexts always present the expected NULL value for this field. This remediation follows established security practices for hypervisor context management and aligns with the principle of least privilege by preventing unauthorized access to kernel memory structures during virtual cpu switching operations. The solution directly addresses the CWE-121 vulnerability category related to buffer overflow conditions in kernel space execution, and mitigates potential attack vectors classified under ATT&CK technique T1068 for local privilege escalation through kernel exploitation.
This vulnerability highlights critical security considerations in hypervisor implementations where context switching mechanisms must maintain strict isolation between host and guest execution environments. The fix demonstrates the importance of proper initialization of kernel data structures during virtualization operations, particularly when transitioning between different execution contexts at varying privilege levels. Organizations deploying Linux-based virtualization solutions should prioritize applying this kernel patch to prevent potential exploitation that could compromise entire virtualized infrastructures through unauthorized access to underlying kernel resources and capabilities.