Cloudanix VulnDB

CVE-2026-64105

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug on certain processor systems could leak resources when virtual machines fail to start, potentially affecting stability in environments that create many virtual machines.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing kvm_vgic_vcpu_destroy() call in kvm_vgic_vcpu_init() failure path after private IRQ allocation leaves allocated IRQs unreleased when redistributor iodev registration fails during arm64 KVM vCPU creation.

Why it matters to the business

Resource leaks during repeated virtual machine creation failures on arm64 Linux systems can degrade host stability and performance over time, especially in environments with high VM churn.

How an attack unfolds

A local attacker triggers KVM vCPU creation failures on arm64 by supplying malformed configurations that reach the vGIC init failure path, causing private IRQs to leak without cleanup and potentially leading to memory pressure or denial of service.

How to fix it

Apply the upstream Linux kernel patch that adds the kvm_vgic_vcpu_destroy call to the kvm_vgic_vcpu_init failure path; rebuild and deploy updated kernel packages for affected arm64 systems.

How to confirm the fix worked

Inspect kvm_arch_vcpu_create source to confirm kvm_vgic_vcpu_destroy is invoked on kvm_vgic_vcpu_init failure; test vCPU creation with forced init failure paths to verify no IRQ leaks occur.

Typical attack path

  1. Obtain local access on arm64 Linux host with KVM
  2. Craft vCPU creation parameters that cause kvm_vgic_vcpu_init to fail after private IRQ allocation
  3. Repeat failure path to accumulate unreleased IRQs
  4. Observe host resource exhaustion or stability degradation

How to detect it

Review kernel logs and dmesg for vCPU creation failure messages around vGIC init without corresponding IRQ release events; examine memory usage trends on arm64 hosts running KVM.

What your security team should do

  • Prioritize kernel updates on all arm64 KVM hosts
  • Monitor kernel logs for vCPU creation failures on arm64
  • Limit untrusted local access to KVM hosts until patched

The record

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free private_irqs when init fails after allocation Companion to commit 250f25367b58 ("KVM: arm64: Tear down vGIC on failed vCPU creation"), which added the missing kvm_vgic_vcpu_destroy() call to the kvm_share_hyp() failure path in kvm_arch_vcpu_create(). The kvm_vgic_vcpu_init() failure path immediately above it has the same shape and still needs the same cleanup. Call kvm_vgic_vcpu_destroy() when kvm_vgic_vcpu_init() fails so private IRQs allocated before a redistributor iodev registration failure are released before the failed vCPU is freed.

Affected packages

Ecosystem Package Introduced Fixed