Search: CVE-2026-64287

CVE-2026-64287 is a high-severity vulnerability in the Linux kernel's KVM subsystem for arm64 architecture. It involves improper bounds checking of the used_lrs value when flushing the pKVM hypervisor virtual CPU state. This flaw allows the host-provided value to be used unchecked at EL2 to index internal registers, potentially leading to memory access violations. The issue is fixed by clamping used_lrs to the number of implemented list registers after copying the state. The vulnerability affects Linux kernel version 6.2.