KVM is core virtualization; a guest‑triggered kernel memory corruption can enable VM escape or host outage across cloud/hypervisor environments.
CVE-2026-74568
ARM64 KVM VGIC LPI race enabling guest-triggered host kernel memory corruption
Is CVE-2026-74568 being exploited?
Not confirmed. CVE-2026-74568 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.12% probability of exploitation in the next 30 days.
How severe is CVE-2026-74568?
CVE-2026-74568 is rated Critical. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-74568?
Yes. A fix has been recorded for CVE-2026-74568. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-74568 affect?
CVE-2026-74568 affects Linux kernel (arm64) KVM, VGIC LPI subsystem, Hypervisors using ARM64 KVM. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-74568?
Install vendor kernel updates on hypervisors, reboot hosts, and restrict untrusted guests.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Malicious guest can trigger host kernel use-after-free or wrong LPI deletion, causing host crash or potential guest-to-host escape/privilege escalation.
Immediate action required
- affected>= 3a08a6ca7c373198c84e2a8c025c395ee966ff8a and < 292e80a159aa88635bf668a7212cfdf526b8bd52
- affected>= 3a08a6ca7c373198c84e2a8c025c395ee966ff8a and < cbfe2b24a1ea9de35032dbdd100fdc700f5be92d
- affected6.17
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.