What is the CVSS score of CVE-2026-64106?

CVE-2026-64106 has a contested CVSS base score of 9.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64106?

CVE-2026-64106 is a critical Linux virtualization vulnerability (CVSS 9.0) that allows local attackers to crash systems or expose kernel memory.. A patch is available.

How to fix or mitigate CVE-2026-64106?

Within 24 hours, inventory all systems running vulnerable Linux kernel versions with arm64 KVM virtualization enabled, prioritizing production hypervisors and multi-tenant environments. Over the next seven days, obtain the patched Linux kernel from your vendor, test it in a staging environment, and deploy to all affected systems. By day 30, verify that the patch has been deployed across all arm64 virtualized infrastructure and validate that KVM isolation remains intact.

Linux Kernel CVE-2026-64106

EUVD-2026-45791 CRITICAL

2026-07-19 Linux

GHSA-gf7v-gpf5-6fgc

Information Disclosure Linux

Critical

Disputed · 9.0 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.0 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

vuln.today AI

8.4 HIGH

Reaching the ITS restore path needs local control of the VMM/KVM ioctls, so PR:L; OOB read leaks host memory across a scope change (S:C, C:H) and can crash the host (A:H), no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:28 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.0 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

CRITICAL 9.0

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits.

Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.

AnalysisAI

Out-of-bounds host memory access in the Linux kernel's arm64 KVM virtual ITS (vgic-its) subsystem allows a local user driving the VM migration/restore path to disclose kernel memory and crash the host. The flaw lets userspace restore an ITS Device Table Entry (DTE) whose Size field encodes more EventID bits than the virtual ITS supports; vgic_its_restore_dte() stores this out-of-range num_eventid_bits, which later produces an oversized scan_its_table() range. It carries a high CVSS (9.0) but a very low EPSS (0.18%), with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The affected component is the arm64 KVM in-kernel GICv3 ITS (Interrupt Translation Service) emulation. When a VMM (e.g. QEMU) saves/restores a VM, it serializes the ITS device and collection tables; on restore, vgic_its_restore_dte() parses each Device Table Entry, where the Size field encodes the number of EventID bits the virtual device supports. VITS_TYPER_IDBITS defines the upper bound the virtual ITS actually supports. The live MAPD (map device) command path already validates this bound, but the restore path did not, so an attacker-supplied num_eventid_bits greater than VITS_TYPER_IDBITS was stored in dev->num_eventid_bits and propagated into vgic_its_restore_itt(), where it was converted into an oversized scan_its_table() iteration range - an out-of-bounds read / improper input validation issue (CWE-129 improper validation of array index / CWE-125 out-of-bounds read class; CWE was N/A in source). The tags label this Information Disclosure, consistent with the C:H/A:H, I:N impact profile.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11 or 7.1 (or later on your branch), pulling the corresponding stable commit (e.g. https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d and the other listed hashes for each branch). If you cannot immediately patch, the exposure is limited to arm64 hosts running KVM guests with emulated GICv3 ITS and VM save/restore or live migration enabled - as a compensating control, avoid restoring/migrating VM state from untrusted or attacker-influenced sources, and where feasible disable in-kernel ITS emulation or ITS-based migration for guests that do not require it (trade-off: breaks MSI/large-interrupt-count guest configurations and live migration of ITS-backed VMs). Restrict access to the VMM and KVM device ioctls to trusted operators only. This is not exploitable on x86 or on arm64 hosts without ITS emulation.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64106 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64106

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code