Linux KVM ARM64 vGIC List Register Boundary Bypass

CVE-2026-64287 is a memory safety vulnerability in the Linux kernel's KVM hypervisor implementation for ARM64 architecture. The vulnerability exists in the flush_hyp_vcpu() function, which copies host vGIC (Virtual Generic Interrupt Controller) state into the hypervisor's private vCPU without validating critical boundary conditions. Specifically, the used_lrs (used list registers) field is copied verbatim from host-controlled data without enforcement against the actual number of implemented list registers, creating an out-of-bounds condition. This affects Linux systems running KVM with ARM64 support, particularly those hosting virtual machines where a malicious or compromised host could exploit this to corrupt hypervisor memory, potentially breaking isolation between VMs or between VM and host.

While CVE-2026-64287 lacks explicit MITRE ATT&CK technique mapping, Casky's 754 security skills powered by Claude AI with extended reasoning would identify attack patterns consistent with Memory Corruption (CWE-119) and Privilege Escalation (MITRE T1134) techniques. A practitioner using Casky would see detections focused on: (1) unsafe kernel memory operations without bounds checking, (2) host-to-hypervisor data flows that bypass validation, and (3) register allocation logic that trusts untrusted input. The findings would flag the lack of input validation between trust boundaries and highlight how an attacker could leverage this for hypervisor escape or VM isolation bypass, enabling lateral movement between virtualized workloads or host compromise.