CVE-2026-64106

Linux kernel KVM arm64 vgic-its vulnerability: a userspace process can restore an ITS Device Table Entry with a Size encoding more EventID bits than the virtual ITS supports. Although MAPD rejects the state, vgic_its_restore_dte() stores the out-of-range value in dev->num_eventid_bits, allowin...

CVE-2026-64106

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

CVE-2026-64106 KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

CVE-2026-64106

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

CVE-2026-64105

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-64105

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-64105 KVM: arm64: vgic: Free private_irqs when init fails after allocation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-64104 virt: sev-guest: Explicitly leak pages in unknown state

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...

CVE-2026-64018

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In Confidential VMs SEV-SNP/TDX, this memory is shared unencrypted and HW c...

CVE-2026-64018 net: mana: validate rx_req_idx to prevent out-of-bounds array access

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In Confidential VMs SEV-SNP/TDX, this memory is shared unencrypted and HW c...

CVE-2026-63941 KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which does not trap. KVM handles both in different way: - on ZCREL2 trap,...

EUVD-2026-45714

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which does not trap. KVM handles both in different way: - on ZCREL2 trap,...

CVE-2026-63941

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which does not trap. KVM handles both in different way: - on ZCREL2 trap,...

EUVD-2026-45713

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' or count '0', so that setting up the software scratch area and other code doesn't have to worry about underflowing the length, and...

CVE-2026-63940 KVM: SEV: Ignore Port I/O requests of length '0'

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' or count '0', so that setting up the software scratch area and other code doesn't have to worry about underflowing the length, and...

CVE-2026-63939 KVM: SEV: Compute the correct max length of the in-GHCB scratch area

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...

CVE-2026-63938 KVM: SEV: Check PSC request indices against the actual size of the buffer

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change PSC requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximu...

EUVD-2026-45712

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...

CVE-2026-63939

CVE-2026-63939 (Linux kernel, KVM SEV): The issue concerns computation of the maximum length for the in-GHCB scratch area in the GHCB shared buffer. Previously, KVM assumed the input length (@len) always represented the maximum required size for MMIO emulation; for PSC requests, @len is only the ...

CVE-2026-63938

The vulnerability CVE-2026-63938 affects the Linux kernel KVM SEV path, specifically PSC processing. The issue arises when validating PSC requests: the PSC buffer must be checked against the effective size of the scratch area, which may be smaller than the maximum if a guest supplies a pointer no...