{"cve":"CVE-2026-64106","nvd":{"published":"2026-07-19T16:17:51.887","modified":"2026-10-19T21:17:23.337","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits\n\nUserspace can restore an ITS Device Table Entry whose Size field encodes\nmore EventID bits than the virtual ITS supports.  The live MAPD path\nrejects that state, but vgic_its_restore_dte() accepts it and stores the\nout-of-range value in dev->num_eventid_bits.\n\nReject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before\nallocating the device.  This mirrors the MAPD check and prevents the\nrestored state from reaching vgic_its_restore_itt(), where the unchecked\nvalue can be converted into an oversized scan_its_table() range.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","score":9.0},"cwes":["CWE-20"],"references":["https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316","https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d","https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95","https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07","https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2026-64106","score":0.00149,"percentile":0.04003,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}