{"id":"CVE-2026-64105","title":"KVM: arm64: vgic: Free private_irqs when init fails after allocation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Free private_irqs when init fails after allocation\n\nCompanion to commit 250f25367b58 (\"KVM: arm64: Tear down vGIC on\nfailed vCPU creation\"), which add…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 03b3d00a70b55857439511c1b558ca00a99f4126 < 173fb86e5519dbe7aabed1f5fa7456152a4a2e38","Linux >= 03b3d00a70b55857439511c1b558ca00a99f4126 < 7023900b4988fb6f4a59d304d878003ff562e98d","Linux >= 03b3d00a70b55857439511c1b558ca00a99f4126 < e690caa54a6139d98495ac69626807623520babd","Linux >= 03b3d00a70b55857439511c1b558ca00a99f4126 < f19c354dbd457759dfcf1195ab4bdba2bb568323","Linux 6.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:29:57.826906Z"},"published":"2026-07-19","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:26.031Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64105","references":[{"url":"https://git.kernel.org/stable/c/173fb86e5519dbe7aabed1f5fa7456152a4a2e38"},{"url":"https://git.kernel.org/stable/c/7023900b4988fb6f4a59d304d878003ff562e98d"},{"url":"https://git.kernel.org/stable/c/e690caa54a6139d98495ac69626807623520babd"},{"url":"https://git.kernel.org/stable/c/f19c354dbd457759dfcf1195ab4bdba2bb568323"}],"tags":["cve.org"],"epss":0.00162,"epssPercentile":0.05386,"ingestedAt":"2026-11-06T16:57:43.235Z","slug":"CVE-2026-64105","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Free private_irqs when init fails after allocation\n\nCompanion to commit 250f25367b58 (\"KVM: arm64: Tear down vGIC on\nfailed vCPU creation\"), which added the missing kvm_vgic_vcpu_destroy()\ncall to the kvm_share_hyp() failure path in kvm_arch_vcpu_create(). The\nkvm_vgic_vcpu_init() failure path immediately above it has the same\nshape and still needs the same cleanup.\n\nCall kvm_vgic_vcpu_destroy() when kvm_vgic_vcpu_init() fails so private\nIRQs allocated before a redistributor iodev registration failure are\nreleased before the failed vCPU is freed.\n\n## Affected\n\n- `Linux >= 03b3d00a70b55857439511c1b558ca00a99f4126 < 173fb86e5519dbe7aabed1f5fa7456152a4a2e38`\n- `Linux >= 03b3d00a70b55857439511c1b558ca00a99f4126 < 7023900b4988fb6f4a59d304d878003ff562e98d`\n- `Linux >= 03b3d00a70b55857439511c1b558ca00a99f4126 < e690caa54a6139d98495ac69626807623520babd`\n- `Linux >= 03b3d00a70b55857439511c1b558ca00a99f4126 < f19c354dbd457759dfcf1195ab4bdba2bb568323`\n- `Linux 6.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}