The Linux kernel vulnerability CVE-2026-64284 involves the KVM subsystem on x86 architectures. The flaw was that the vendor's exit handler did not run before fastpath userspace exits, which could cause critical vendor-specific operations, such as flushing the PML buffer, to be skipped. This could result in memory writes made by the final KVM_RUN not being flagged as dirty, potentially impacting memory management correctness. The fix moves the handling of fastpath userspace exits into vendor code to ensure these operations occur before userspace regains control of the virtual CPU. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-31.31 and related builds. The issue is addressed in updated kernel packages as per the Ubuntu security advisories USN-8726-1 and USN-8727-1.

The vulnerability could cause memory writes performed by KVM to not be properly flagged as dirty, which may affect memory management and system stability. The CVSS score of 7.1 reflects a medium severity with high impact on integrity and availability but no confidentiality impact. There are no known exploits in the wild. The issue could potentially lead to privilege escalation or bypass of memory protections if exploited in conjunction with other vulnerabilities.

A patch is available and should be applied by updating the Linux kernel to the fixed versions specified in the Ubuntu security advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required to apply the changes. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Following the vendor's update instructions will mitigate this vulnerability.