CVE-2026-64286
Arm64 KVM pKVM bug allows hypervisor privilege escalation/RCE
Is CVE-2026-64286 being exploited?
Not confirmed. CVE-2026-64286 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.18% probability of exploitation in the next 30 days.
How severe is CVE-2026-64286?
CVE-2026-64286 is rated High with a CVSS score of 8.2. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-64286?
Yes. A fix has been recorded for CVE-2026-64286. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-64286 affect?
CVE-2026-64286 affects Linux kernel (KVM on arm64), pKVM hyp vCPU, ARM64-based virtual hosts (cloud/on-prem). Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-64286?
Apply vendor Linux kernel security updates for arm64 KVM immediately.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
A guest can trigger a dereference at EL2 in pKVM, enabling hypervisor privilege escalation or remote code execution on the host.
Immediate action required
- affected>= be66e67f175096f283c9d5614c4991fc9e7ed975 and < 477145860dba4c30f0b4e36f02f4c5291c1c888b
- affected>= be66e67f175096f283c9d5614c4991fc9e7ed975 and < dfaef40d8a1533940fc1af788d70fce07362b4ce
- affected>= be66e67f175096f283c9d5614c4991fc9e7ed975 and < 6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa
- affected>= be66e67f175096f283c9d5614c4991fc9e7ed975 and < d4f4d61715d1061ba83b88196a3605662be30750
- affected>= be66e67f175096f283c9d5614c4991fc9e7ed975 and < e8042f6e1d7befb2fb6b10a75918642bcd0acf9a
- affected6.2
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.