In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loop bound and expect it to stay within the number of implemented list registers. While this is generally the case, flush_hyp_vcpu() copies vgic_v3 verbatim and does not enforce this, so a value provided by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2 (host -> EL2).
Fix by clamping used_lrs to the number of implemented list registers after the copy, as the trusted path already does in vgic_flush_lr_state(). The number of implemented list registers is constant after init, so it is replicated once from kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on every entry.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftool6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-develUpgrade kernel6.12-toolsUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-tools-develUpgrade kernel-livepatch-6.12.100-125.179Upgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12Upgrade kernel6.12Upgrade python3-perf6.12Upgrade kernel6.12-headers | Aug 18, 2026 | Jul 25, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Aug 2, 2026 | Aug 2, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 31, 2026 | Jul 25, 2026 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-debug-devel-matchedUpgrade python3-perf-debuginfoUpgrade kernelUpgrade kernel-rt-modules-coreUpgrade libperf-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-modules-extra-matchedUpgrade kernel-zfcpdumpUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade rvUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-tools-libsUpgrade kernel-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-uki-virtUpgrade python3-perfUpgrade libperfUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-uki-virtUpgrade rtlaUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-develUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade kernel-zfcpdump-devel | Sep 15, 2026 | Sep 9, 2026 |
| Ubuntu | — | Upgrade linux-image-oem-26.04bUpgrade linux-image-virtual-7.0Upgrade linux-image-virtualUpgrade linux-image-realtime-64kUpgrade linux-image-aws-7.0Upgrade linux-image-7.0.0-1013-ibmUpgrade linux-image-7.0.0-31-realtimeUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-gcp-7.0Upgrade linux-image-7.0.0-1019-raspiUpgrade linux-image-aws-64k-7.0Upgrade linux-image-7.0.0-1018-nvidiaUpgrade linux-image-raspi-7.0Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-realtime-7.0Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-7.0.0-1006-gkeUpgrade linux-image-7.0.0-31-realtime-64kUpgrade linux-image-awsUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-gke-hwe-26.04Upgrade linux-image-realtimeUpgrade linux-image-7.0.0-1012-aws-64kUpgrade linux-image-7.0.0-2018-nvidia-bos-64kUpgrade linux-image-oem-26.04Upgrade linux-image-nvidia-64k-7.0Upgrade linux-image-ibm-7.0Upgrade linux-image-gke-64kUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-raspiUpgrade linux-image-7.0.0-31-genericUpgrade linux-image-7.0.0-1006-gke-64kUpgrade linux-image-oem-7.0Upgrade linux-image-gke-7.0Upgrade linux-image-generic-7.0Upgrade linux-image-gcpUpgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-nvidiaUpgrade linux-image-oem-26.04aUpgrade linux-image-7.0.0-1012-awsUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-raspi-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-gkeUpgrade linux-image-generic-64kUpgrade linux-image-aws-64kUpgrade linux-image-virtual-hwe-26.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-gcp-64kUpgrade linux-image-7.0.0-1013-oemUpgrade linux-image-nvidia-bosUpgrade linux-image-ibmUpgrade linux-image-7.0.0-31-generic-64kUpgrade linux-image-gke-64k-7.0Upgrade linux-image-generic-64k-7.0Upgrade linux-image-nvidia-64kUpgrade linux-image-7.0.0-1019-raspi-realtimeUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-generic-hwe-26.04Upgrade linux-image-nvidia-7.0Upgrade linux-image-7.0.0-2018-nvidia-bosUpgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-7.0.0-1018-nvidia-64kUpgrade linux-image-nvidia-bos-64k | Sep 14, 2026 | Sep 7, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 13, 2026 | Jul 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub