CyberSecBulletin
CVE-2026-64286NVD status: Modified

Linux: Untrusted Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-64286 is a high-severity untrusted pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited with local access to the system by an attacker with administrator privileges, without any action from a user. The record lists versions 477145860dba4c30f0b4e36f02f4c5291c1c888b, dfaef40d8a1533940fc1af788d70fce07362b4ce, 6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 477145860dba4c30f0b4e36f02f4c5291c1c888b or dfaef40d8a1533940fc1af788d70fce07362b4ce or 6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa or d4f4d61715d1061ba83b88196a3605662be30750, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.6.145 or 6.12.97 or 6.18.39 or 7.1.4, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxbe66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, 477145860dba4c30f0b4e36f02f4c5291c1c888b; be66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, dfaef40d8a1533940fc1af788d70fce07362b4ce; be66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, 6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa; be66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, d4f4d61715d1061ba83b88196a3605662be30750; be66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, e8042f6e1d7befb2fb6b10a75918642bcd0acf9a; 6.2477145860dba4c30f0b4e36f02f4c5291c1c888b, dfaef40d8a1533940fc1af788d70fce07362b4ce, 6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa, d4f4d61715d1061ba83b88196a3605662be30750, e8042f6e1d7befb2fb6b10a75918642bcd0acf9a
LinuxLinux Kernel6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.97; 6.13 up to, but not including, 6.18.39; 6.19 up to, but not including, 7.1.46.6.145, 6.12.97, 6.18.39, 7.1.4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
HighAdministrator-level access is required first.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxt_to_vcpu() expects a guest context to have a NULL __hyp_running_vcpu, which is only ever set on the host context, so that it resolves the vCPU via container_of(). While this is generally the case, flush_hyp_vcpu() copies the context verbatim and does not enforce this, so a value provided by the host is dereferenced at EL2 (host -> EL2). Fix by clearing __hyp_running_vcpu after the copy.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Untrusted Pointer Dereference

The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

More Untrusted Pointer Dereference vulnerabilities (CWE-822)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Untrusted Pointer Dereference vulnerabilities

Spotted an error? Tell us.