Out-of-Bounds Read Vulnerability in Linux Kernel's KVM Hypervisor Product

CVE-2026-64247

What is CVE-2026-64247?

A vulnerability in the Linux kernel's KVM module could lead to an out-of-bounds read condition when validating VP IDs against sparse bank sets. By neglecting to impose a bounds check, a VP ID may exceed defined limits, which can result in unnecessary TLB flush operations for L2 vCPUs, ultimately impacting performance and stability. Ensuring that bounds are strictly adhered to is essential to mitigate risks associated with this potential memory access issue.

References