CyberSecBulletin
CVE-2026-64287NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-64287 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited with local access to the system by an attacker with administrator privileges, without any action from a user. The record lists versions 2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8, 9fa301d8298778dd799fa4dcf7a7f440715d146e, c646431865f4b1a5b14067233fa27b11e05e0d46 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8 or 9fa301d8298778dd799fa4dcf7a7f440715d146e or c646431865f4b1a5b14067233fa27b11e05e0d46 or 7fca3fcef81c713bc82a37bf741e0f28e6d04a6f, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.6.145 or 6.12.97 or 6.18.40 or 7.1.4, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxbe66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, 2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8; be66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, 9fa301d8298778dd799fa4dcf7a7f440715d146e; be66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, c646431865f4b1a5b14067233fa27b11e05e0d46; be66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, 7fca3fcef81c713bc82a37bf741e0f28e6d04a6f; be66e67f175096f283c9d5614c4991fc9e7ed975 up to, but not including, 8cc8bbbfab14c22c5551d0dd19b208a44b141c76; 6.22c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8, 9fa301d8298778dd799fa4dcf7a7f440715d146e, c646431865f4b1a5b14067233fa27b11e05e0d46, 7fca3fcef81c713bc82a37bf741e0f28e6d04a6f, 8cc8bbbfab14c22c5551d0dd19b208a44b141c76
LinuxLinux Kernel6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.97; 6.13 up to, but not including, 6.18.40; 6.19 up to, but not including, 7.1.46.6.145, 6.12.97, 6.18.40, 7.1.4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
HighAdministrator-level access is required first.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loop bound and expect it to stay within the number of implemented list registers. While this is generally the case, flush_hyp_vcpu() copies vgic_v3 verbatim and does not enforce this, so a value provided by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2 (host -> EL2). Fix by clamping used_lrs to the number of implemented list registers after the copy, as the trusted path already does in vgic_flush_lr_state(). The number of implemented list registers is constant after init, so it is replicated once from kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on every entry.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.