CVE-2026-64105: KVM: arm64: vgic: Free private_irqs when init fails after allocation

Q: What conditions are required to trigger this issue?

An attacker needs local access and low privileges, as reflected by the CVSS vector. The affected path requires creation of a KVM arm64 vCPU followed by a kvm_vgic_vcpu_init() failure after private IRQ allocation, such as a redistributor iodev registration failure.

Q: What is the practical impact if the vulnerable failure path is reached?

Private IRQs allocated during vGIC vCPU initialization are not released before the failed vCPU is freed. This can cause resource leakage and availability impact.

Q: What should operators do if they cannot patch immediately?

The provided data identifies a patch as available. No configuration workaround or detection method is provided; prioritize limiting untrusted local users' ability to create or manage KVM virtual CPUs until the patch can be applied.

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Free privateirqs when init fails after allocation

Companion to commit 250f25367b58 ("KVM: arm64: Tear down vGIC on failed vCPU creation"), which added the missing kvmvgicvcpudestroy() call to the kvmsharehyp() failure path in kvmarchvcpucreate(). The kvmvgicvcpuinit() failure path immediately above it has the same shape and still needs the same cleanup.

Call kvmvgicvcpudestroy() when kvmvgicvcpuinit() fails so private IRQs allocated before a redistributor iodev registration failure are released before the failed vCPU is freed.

Affected Software

8 affected components

Linux Linux kernel

Linux Linux kernel>=6.10<6.12.92

Linux Linux kernel>=6.13<6.18.34

Linux Linux kernel>=6.19<7.0.11

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Linux Linux kernel=7.1-rc3

Linux Linux kernel=7.1-rc4

Remediation

Event History

Jul 19, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

Description

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to trigger this issue?

An attacker needs local access and low privileges, as reflected by the CVSS vector. The affected path requires creation of a KVM arm64 vCPU followed by a kvm_vgic_vcpu_init() failure after private IRQ allocation, such as a redistributor iodev registration failure.

What is the practical impact if the vulnerable failure path is reached?

Private IRQs allocated during vGIC vCPU initialization are not released before the failed vCPU is freed. This can cause resource leakage and availability impact.

What should operators do if they cannot patch immediately?

The provided data identifies a patch as available. No configuration workaround or detection method is provided; prioritize limiting untrusted local users' ability to create or manage KVM virtual CPUs until the patch can be applied.

CVE-2026-64105: KVM: arm64: vgic: Free private_irqs when init fails after allocation

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What conditions are required to trigger this issue?

What is the practical impact if the vulnerable failure path is reached?

What should operators do if they cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger this issue?

What is the practical impact if the vulnerable failure path is reached?

What should operators do if they cannot patch immediately?