CVE-2026-64286

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-64286

Key Details

CVE	CVE-2026-64286
CVSS Score / Version	8.2 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is high; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU

flush_hyp_vcpu() copies the host vCPU context into the hyp's private

vCPU on every run. ctxt_to_vcpu() expects a guest context to have a

NULL __hyp_running_vcpu, which is only ever set on the host context, so

that it resolves the vCPU via container_of(). While this is generally

the case, flush_hyp_vcpu() copies the context verbatim and does not

enforce this, so a value provided by the host is dereferenced at EL2

(host -> EL2).

Fix by clearing __hyp_running_vcpu after the copy. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-64286
CVE	https://www.cve.org/CVERecord?id=CVE-2026-64286

Source

Reference

NVD

CVE