CVE-2026-64286 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
A missing pointer clearance in KVM arm64 allows a malicious host to trigger a null dereference at EL2, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64286?
CVE-2026-64286 is a high-severity vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
flush_hyp_vcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxt_to_vcpu() expects a guest context to have a NULL __hyp_running_vcpu, which is only ever set on the host context, so that it resolves the vCPU via container_of(). While this is generally the case, flush_hyp_vcpu() copies the context verbatim and does not enforce this, so a value provided by the host is dereferenced at EL2 (host -> EL2).
Fix by clearing __hyp_running_vcpu after the copy.
Weakness: CWE-822
Which versions are affected by CVE-2026-64286?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64286?
Apply the vendor's patch.
Is CVE-2026-64286 being exploited?
There is no known exploitation of CVE-2026-64286 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93695, BELL-CVE-2026-64286, DEBIAN-CVE-2026-64286, GHSA-5rwh-cw23-rrm6, ROOT-OS-DEBIAN-13-CVE-2026-64286, ROOT-OS-UBUNTU-2204-CVE-2026-64286 and 1 more.