CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits

Userspace can restore an ITS Device Table Entry whose Size field encodes
more EventID bits than the virtual ITS supports.  The live MAPD path
rejects that state, but vgic_its_restore_dte() accepts it and stores the
out-of-range value in dev->num_eventid_bits.

Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before
allocating the device.  This mirrors the MAPD check and prevents the
restored state from reaching vgic_its_restore_itt(), where the unchecked
value can be converted into an oversized scan_its_table() range.

The Linux kernel CVE team has assigned CVE-2026-64106 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.12 with commit 57a9a117154c93539e33161dd318e6aeb8c04efa and fixed in 6.1.175 with commit 1716b7fea2ead941a0dfac06c4504a3437cdf00d
	Issue introduced in 4.12 with commit 57a9a117154c93539e33161dd318e6aeb8c04efa and fixed in 6.6.142 with commit dab9f93251b2c86a033de6098d0c73afddd55d4a
	Issue introduced in 4.12 with commit 57a9a117154c93539e33161dd318e6aeb8c04efa and fixed in 6.12.92 with commit b94538186a3eae3763b8f96dacd610920a865aa7
	Issue introduced in 4.12 with commit 57a9a117154c93539e33161dd318e6aeb8c04efa and fixed in 6.18.34 with commit 0680f511926589206f81f57f76ce131d7741a316
	Issue introduced in 4.12 with commit 57a9a117154c93539e33161dd318e6aeb8c04efa and fixed in 7.0.11 with commit 8bcd15b690a390241179516af1b6ae49ebfd9d95
	Issue introduced in 4.12 with commit 57a9a117154c93539e33161dd318e6aeb8c04efa and fixed in 7.1 with commit 9ce754ed8e7ab4e3999767ce1505f85c449ccb07

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64106
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/arm64/kvm/vgic/vgic-its.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d
	https://git.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4a
	https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7
	https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316
	https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95
	https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07