Linux kernel pKVM on arm64: unbounded host-supplied vGIC used_lrs indexes list registers at EL2

Impact

A second flaw in the same pKVM context-flush path, distinct from CVE-2026-64286: flush_hyp_vcpu() copied the host's vgic_v3 state verbatim, so a host-controlled used_lrs value was used at EL2 as the loop bound for saving and restoring the GIC list registers. That indexes vgic_lr[] and ICH_LR<n>_EL2 past the number of implemented list registers, giving a malicious host out-of-bounds access inside the hypervisor. As with the sibling bug, the consequence is a host-to-EL2 escalation that breaks the isolation protected KVM is deployed for, which matters on arm64 accelerator hosts running confidential guests and not at all on hosts without pKVM. The fix clamps used_lrs to the implemented count after the copy, mirroring what the trusted path in vgic_flush_lr_state() already did.

Who can reach it

Local, high privilege: the host kernel (EL1) attacking EL2 on an arm64 system running protected KVM. Not reachable from a guest or from an unprivileged host user, and not remote.

What to do

Update to a stable kernel carrying the clamp (five commits linked in the record) and reboot each affected arm64 host. Ship it together with CVE-2026-64286, which lives in the same function, so one drain and reboot covers both. No fixed version numbers are given in the record.

References

Related entries

• Linux kernel (drivers/iommu/intel): A device that does not support ATS never gets inserted into the VT-d deviceCVE-2026-74355 · Linux kernel (drivers/iommu/intel)High
• Linux kernel (arch/x86/kvm/svm): If AVIC is inhibited while a nested guest is running, KVM leaves the x2APIC MSRsCVE-2026-74516 · Linux kernel (arch/x86/kvm/svm)High
• Linux NFSD: NFSv2 SETATTR/CREATE useconds wrap to a bogus tv_nsec on 32-bit serversCVE-2026-89665 · Linux kernel NFSD (svcxdr_decode_sattr, NFSv2 useconds conversion)High
• Linux NFSD: bogus WARN_ON_ONCE fires on NFS re-export lookupsCVE-2026-89711 · Linux kernel NFSD (nfsd_mode_check WARN_ON_ONCE, NFS re-export)High
• Linux kernel nvme-tcp: a controller can force a host WARN by answering a write with C2HDataCVE-2026-89973 · Linux kernel nvme-tcp (C2HData PDU direction check)High
• Linux iommu/vt-d: probe failure frees a PASID table still referenced by live context entriesCVE-2026-90241 · Linux kernel iommu/vt-d (scalable-mode context teardown on probe failure)High