What is the CVSS score of CVE-2026-64105?

CVE-2026-64105 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64105?

Yes, a patch is available for CVE-2026-64105. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64105

EUVD-2026-45790 MEDIUM

2026-07-19 Linux

GHSA-525g-3r8r-9mf7

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local kvm-group access required to create vCPUs; pure availability impact via kernel memory leak; no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:11 vuln.today

CVSS changed

Aug 12, 2026 - 15:52 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic: Free private_irqs when init fails after allocation

Companion to commit 250f25367b58 ("KVM: arm64: Tear down vGIC on failed vCPU creation"), which added the missing kvm_vgic_vcpu_destroy() call to the kvm_share_hyp() failure path in kvm_arch_vcpu_create(). The kvm_vgic_vcpu_init() failure path immediately above it has the same shape and still needs the same cleanup.

Call kvm_vgic_vcpu_destroy() when kvm_vgic_vcpu_init() fails so private IRQs allocated before a redistributor iodev registration failure are released before the failed vCPU is freed.

AnalysisAI

KVM arm64 vGIC in the Linux kernel leaks kernel memory when vCPU initialization fails, enabling a local attacker with VM-creation privileges to exhaust host memory and cause denial of service. The defect is a missing cleanup call in the kvm_vgic_vcpu_init() error path: private IRQs allocated prior to a redistributor iodev registration failure are never freed before the failed vCPU structure is released. No public exploit has been identified at time of analysis; an EPSS score of 0.17% (6th percentile) reflects low opportunistic exploitation probability, and the flaw is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the KVM (Kernel-based Virtual Machine) subsystem for the AArch64 (arm64) architecture, specifically within the vGIC (Virtual Generic Interrupt Controller) component that emulates the ARM GIC redistributor for guest virtual CPUs. When kvm_arch_vcpu_create() calls kvm_vgic_vcpu_init() and that function fails - for example during iodev registration of the per-vCPU redistributor interface - the private_irqs array allocated earlier in the same function is not released. The companion commit 250f25367b58 already fixed the analogous leak in the kvm_share_hyp() failure path; this fix closes the remaining identical gap. The root cause is a classic resource-cleanup omission on an error path (analogous to CWE-401, Missing Release of Memory after Effective Lifetime), though no formal CWE has been assigned. Affected CPE is cpe:2.3:a:linux:linux across multiple stable branches prior to their respective fix commits on kernel.org.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel: 7.0.11, 6.18.34, or 6.12.92 on the respective stable branches, or any 7.1+ kernel incorporating the fix commits referenced on kernel.org stable trees (https://git.kernel.org/stable/c/f19c354dbd457759dfcf1195ab4bdba2bb568323, https://git.kernel.org/stable/c/7023900b4988fb6f4a59d304d878003ff562e98d, https://git.kernel.org/stable/c/e690caa54a6139d98495ac69626807623520babd, https://git.kernel.org/stable/c/173fb86e5519dbe7aabed1f5fa7456152a4a2e38). Ubuntu administrators should apply the patch referenced in USN-8593-1. If immediate patching is not feasible, a compensating control is to restrict /dev/kvm access to only trusted administrative accounts (remove unprivileged users from the kvm group), which eliminates the low-privilege attack surface; this trade-off reduces VM usability for non-root users. Systems that do not use KVM virtualization on arm64 hosts are not exposed and need not prioritize this fix.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64105 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64105

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code