CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Clear hyprunningvcpu when flushing the pKVM hyp vCPU
flushhypvcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxttovcpu() expects a guest context to have a NULL hyprunningvcpu, which is only ever set on the host context, so that it resolves the vCPU via containerof(). While this is generally the case, flushhypvcpu() copies the context verbatim and does not enforce this, so a value provided by the host is dereferenced at EL2 (host -> EL2).
Fix by clearing hyprunningvcpu after the copy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Compensating control
After flush_hyp_vcpu() copies the host vCPU context into the hyp's private vCPU, clear __hyp_running_vcpu.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64286?
The severity of CVE-2026-64286 is rated high with a CVSS score of 8.2.
How do I fix CVE-2026-64286?
You can fix CVE-2026-64286 by applying the available patch as indicated in the Linux kernel updates.
What systems are affected by CVE-2026-64286?
CVE-2026-64286 affects the Linux kernel and specifically Microsoft Azure's azl3 kernel.
What does CVE-2026-64286 exploit?
CVE-2026-64286 exploits an issue in the KVM for arm64 architecture that improperly manages vCPU context during operations.
When was CVE-2026-64286 published?
CVE-2026-64286 was published on July 25, 2026.