CVE-2026-64555
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2…
- Risk score
- 68/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 27 Jul 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in the Linux kernel's KVM module for arm64 architecture has been resolved. An attacker could potentially exploit this flaw to gain control of the system.
- Affected
- {'product': 'Linux kernel', 'package': 'KVM module for arm64 architecture', 'version': 'unknown'}
- Fix
- Check the linked advisory for details on the fix
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…
The flaws
- CVE-2026-64555: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2… (CVSS 8.8 · EPSS 0%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Fix: Check the linked advisory for the concrete fix.
Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
- 6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 147 in the last 90 days
Why it is Amber
- CVSS 8.8 high
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-9003-1
- https://git.kernel.org/stable/c/10a568010e827108d149779908850afaec898846
- https://git.kernel.org/stable/c/884b44256041ec6b2dcbe8e6a67384d26145cba1
- https://git.kernel.org/stable/c/dd3b237eb7780d65eae296d3d3a70012b6e7a02f
- https://git.kernel.org/stable/c/ff1022c3de46753eb7eba2f6efd990569e66ff95
Original description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writing the result directly into hardware. In the case of nested virtualization, vcpu_cpsr() is a synthetic value such that the rest of KVM can deal with vEL2 cleanly. That means the value requires translation before being written into hardware, which is unfortunately missing from the MOPS handler. Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state altogether, which will be resynchronized on the next 'full' exit back to KVM.
Last activity 6 Nov 2026. Patch Forecast updates every hour.