已开启

CVE-2026-64247 #16837

zouyipeng创建于 7月28日

7月28日创建

一、漏洞信息
漏洞编号：CVE-2026-64247
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.12.33,6.18.18,6.4.0,6.6.0
CVSS评分：
BaseScore：N/A None
Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:KVM: x86: hyper-v: Bound the bank index when querying sparse banksWhen checking if a VP ID is included in a sparse bank set, explicitly checkthat the ID can actually be contained in a sparse bank (the TLFS allows fora maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLBflush for L2, the VP ID is copied verbatim from the enlightened VMCS,without any bounds check, i.e. isn t guaranteed to be under the limit of4096.Failure to check the bounds of the VP ID leads to an out-of-bounds readwhen testing the sparse bank, and super strictly speaking could lead to KVMperforming an unnecessary TLB flush for an L2 vCPU. ================================================================== BUG: KASAN: use-after-free in hv_is_vp_in_sparse_set+0x85/0x100 [kvm] Read of size 8 at addr ffff88811ba5f598 by task hyperv_evmcs/2802 CPU: 12 UID: 1000 PID: 2802 Comm: hyperv_evmcs Not tainted 7.1.0-rc2 #7 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: dump_stack_lvl+0x51/0x60 print_report+0xcb/0x5d0 kasan_report+0xb4/0xe0 kasan_check_range+0x35/0x1b0 hv_is_vp_in_sparse_set+0x85/0x100 [kvm] kvm_hv_flush_tlb+0xe9e/0x16c0 [kvm] kvm_hv_hypercall+0xe6b/0x1e60 [kvm] vmx_handle_exit+0x485/0x1b60 [kvm_intel] kvm_arch_vcpu_ioctl_run+0x22e3/0x5070 [kvm] kvm_vcpu_ioctl+0x5d0/0x10c0 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0xb9/0xcf0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f0e62d1a9bf The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x11ba5f flags: 0x4000000000000000(zone=1) raw: 4000000000000000 0000000000000000 00000000ffffffff 0000000000000000 raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88811ba5f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88811ba5f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88811ba5f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taintOpportunistically add a compile time assertion to ensure the maximum numberof sparse banks exactly matches the number of possible bits in the passedin mask.[sean: add KASAN splat, drop comment, add assert, massage changelog]
漏洞公开时间：2026-07-25 00:16:54
漏洞创建时间：2026-07-28 09:36:14
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-64247

更多参考(点击展开)

参考来源	参考链接	来源链接
	https://nvd.nist.gov/vuln/detail/CVE-2026-64247
	https://lore.kernel.org/linux-cve-announce/2026072419-CVE-2026-64247-3d6b@gregkh/T/#u
	https://git.kernel.org/stable/c/83c2f52c6a78b1590034e955cff3fe0b052fe4ae
	https://git.kernel.org/stable/c/e36095d8d922bb26ce860231aacf0cd14edea07c
	https://git.kernel.org/stable/c/d18756b12aab30d07794446445c93112e5c69a2e
	https://lore.kernel.org/linux-cve-announce/2026072419-CVE-2026-64247-3d6b@gregkh/T
	https://git.kernel.org/stable/c/f636cf6a1e7b7f40d48d8d08bd5f152aa61dd130
	https://git.kernel.org/stable/c/4721f8160f17554b003e8928bb61e6c9b2fe92a3
	https://www.cve.org/CVERecord?id=CVE-2026-64247
	https://bugzilla.redhat.com/show_bug.cgi?id=2506797

漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
七彩瞬析开源风险感知平台
漏洞补丁信息：

详情(点击展开)

影响的包	修复版本	修复补丁	问题引入补丁	来源
		https://git.kernel.org/stable/c/83c2f52c6a78b1590034e955cff3fe0b052fe4ae		cvelistv5
		https://git.kernel.org/stable/c/e36095d8d922bb26ce860231aacf0cd14edea07c		cvelistv5
		https://git.kernel.org/stable/c/d18756b12aab30d07794446445c93112e5c69a2e		cvelistv5
		https://git.kernel.org/stable/c/f636cf6a1e7b7f40d48d8d08bd5f152aa61dd130		cvelistv5
		https://git.kernel.org/stable/c/4721f8160f17554b003e8928bb61e6c9b2fe92a3		cvelistv5

二、漏洞分析结构反馈
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:KVM: x86: hyper-v: Bound the bank index when querying sparse banksWhen checking if a VP ID is included in a sparse bank set, explicitly checkthat the ID can actually be contained in a sparse bank (the TLFS allows fora maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLBflush for L2, the VP ID is copied verbatim from the enlightened VMCS,without any bounds check, i.e. isn't guaranteed to be under the limit of4096.Failure to check the bounds of the VP ID leads to an out-of-bounds readwhen testing the sparse bank, and super strictly speaking could lead to KVMperforming an unnecessary TLB flush for an L2 vCPU. ================================================================== BUG: KASAN: use-after-free in hv_is_vp_in_sparse_set+0x85/0x100 [kvm] Read of size 8 at addr ffff88811ba5f598 by task hyperv_evmcs/2802 CPU: 12 UID: 1000 PID: 2802 Comm: hyperv_evmcs Not tainted 7.1.0-rc2 #7 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x51/0x60 print_report+0xcb/0x5d0 kasan_report+0xb4/0xe0 kasan_check_range+0x35/0x1b0 hv_is_vp_in_sparse_set+0x85/0x100 [kvm] kvm_hv_flush_tlb+0xe9e/0x16c0 [kvm] kvm_hv_hypercall+0xe6b/0x1e60 [kvm] vmx_handle_exit+0x485/0x1b60 [kvm_intel] kvm_arch_vcpu_ioctl_run+0x22e3/0x5070 [kvm] kvm_vcpu_ioctl+0x5d0/0x10c0 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0xb9/0xcf0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f0e62d1a9bf </TASK> The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x11ba5f flags: 0x4000000000000000(zone=1) raw: 4000000000000000 0000000000000000 00000000ffffffff 0000000000000000 raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88811ba5f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88811ba5f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88811ba5f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taintOpportunistically add a compile time assertion to ensure the maximum numberof sparse banks exactly matches the number of possible bits in the passedin mask.[sean: add KASAN splat, drop comment, add assert, massage changelog]The Linux kernel CVE team has assigned CVE-2026-64247 to this issue.
openEuler评分：
8.4
Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(6.18.40):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响
4.openEuler-24.03-LTS-Next(6.6.0):不受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP3(6.6.0):受影响
7.openEuler-24.03-LTS-SP4(6.6.0):受影响
8.openEuler-22.03-LTS-SP3(5.10.0):受影响
9.openEuler-24.03-LTS(6.6.0):受影响
10.openEuler-24.03-LTS-SP2(6.6.0):受影响

修复是否涉及abi变化(是/否)：
1.master(6.18.40):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP4(5.10.0):否
4.openEuler-24.03-LTS-Next(6.6.0):否
5.openEuler-24.03-LTS-SP1(6.6.0):否
6.openEuler-24.03-LTS-SP3(6.6.0):否
7.openEuler-24.03-LTS-SP4(6.6.0):否
8.openEuler-22.03-LTS-SP3(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
1.master(6.18.40):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
4.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-SP1(6.6.0):正常修复
6.openEuler-24.03-LTS-SP3(6.6.0):正常修复
7.openEuler-24.03-LTS-SP4(6.6.0):正常修复
8.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
9.openEuler-24.03-LTS(6.6.0):不修复-超出修复范围
10.openEuler-24.03-LTS-SP2(6.6.0):不修复-超出修复范围

devstation-robot

7月28日评论：

检测到新建 CVE Issue，CVE-ID: CVE-2026-64247。

你可以通过以下两种方式使用 CVE 修复服务：

分支影响分析
- 在本 Issue 下评论：/analysis_branches
- 系统将自动分析各个分支是否受影响，并在本 Issue 下给出表格形式的分析结果；
在指定分支上创建 PR（修复提交）
- 在本 Issue 下按如下格式评论（字段均为必填，每个字段单独一行）：

/create_pr

branch: OLK-6.6 OLK-5.10
name: dev
email: dev@devstation.com
backport-engine: mystique

说明：
- branch: 需要创建 PR 的目标分支列表，例如 OLK-6.6 OLK-5.10；
- name: PR 签名人姓名（如责任人或安全负责人）；
- email: PR 签名人邮箱；
- backport-engine（可选）: 回移植引擎，可设为 mystique 切换迁移方案，不填则使用默认引擎；

系统会根据上述信息自动在指定分支上创建 PR，并在本 Issue 下反馈结果。

provided by DevStation.

分支状态	原因说明	使用场景
受影响	正常修复	受影响且需要修复（包含升级版本修复）的漏洞；受影响且已经修复的漏洞（历史修复PR也需要关联issue）；若因特殊原因无法修复，应修改原因说明为【不修复-特殊原因】，并在安委会备案相关情况。
受影响	漏洞仍在分析中	已关注到相关漏洞，正在处理，未明确漏洞影响和修复方案。
受影响	暂不修复-暂无解决方案或补丁	当前没有可用的修复或补救措施。【影响性分析】中应包含有关为什么没有修复或补救措施的详细说明、上游相关PR等。
受影响	不修复-超出修复范围	没有漏洞的修复计划。当版本停维、软件包宣布生命周期终止或弃用使用。
受影响	不修复-特殊原因导致不再修复	如存在其他特殊情况不修复相关漏洞，或评估后无法升级修复，应在openEuler社区安全委员会例会进行说明备案。【影响性分析】中应包含不发布修复的详细说明、特殊情况还应有安委会会议纪要。
不受影响	不受影响-组件不存在	软件不受影响，因为易受攻击的组件不在产品中。
不受影响	不受影响-已有内置的内联控制或缓解措施	内置的内联控制或缓解措施可防止攻击者利用漏洞
不受影响	不受影响-漏洞代码不能被攻击者触发	易受攻击的组件存在，并且该组件包含易受攻击的代码。但是，易受攻击的代码的使用方式使得攻击者无法进行任何预期的攻击。
不受影响	不受影响-漏洞代码不在执行路径	易受影响的代码在执行过程中不可访问，包括产品的非预期状态。产品不使用也不执行的组件。
不受影响	不受影响-漏洞代码不存在	产品不受影响，因为漏洞背后的代码在产品中不存在。与component_not_present不同的是，有问题的组件存在，但由于某种原因（例如安全的编译器选项）使漏洞的特定代码不存在于组件中。

参考网址	关联pr	状态	补丁链接
https://www.opencve.io/cve/CVE-2026-64247	None	None	https://git.kernel.org/stable/c/e36095d8d922bb26ce860231aacf0cd14edea07c https://git.kernel.org/stable/c/83c2f52c6a78b1590034e955cff3fe0b052fe4ae https://git.kernel.org/stable/c/d18756b12aab30d07794446445c93112e5c69a2e https://git.kernel.org/stable/c/4721f8160f17554b003e8928bb61e6c9b2fe92a3 https://git.kernel.org/stable/c/f636cf6a1e7b7f40d48d8d08bd5f152aa61dd130
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-64247
https://security-tracker.debian.org/tracker/CVE-2026-64247	None	None	https://git.kernel.org/linus/4721f8160f17554b003e8928bb61e6c9b2fe92a3
http://www.cnnvd.org.cn/web/vulnerability/queryLds.tag?qcvCnnvdid=CVE-2026-64247
https://nvd.nist.gov/vuln/detail/CVE-2026-64247	None	None	https://git.kernel.org/stable/c/e36095d8d922bb26ce860231aacf0cd14edea07c https://git.kernel.org/stable/c/83c2f52c6a78b1590034e955cff3fe0b052fe4ae https://git.kernel.org/stable/c/d18756b12aab30d07794446445c93112e5c69a2e https://git.kernel.org/stable/c/4721f8160f17554b003e8928bb61e6c9b2fe92a3 https://git.kernel.org/stable/c/f636cf6a1e7b7f40d48d8d08bd5f152aa61dd130
https://ubuntu.com/security/CVE-2026-64247

目标分支	是否受影响	适配状态	是否存在冲突	PR 链接
OLK-6.6	Affected	success	No	-
OLK-5.10	Not affected	-	No	-
openEuler-1.0-LTS	Not affected	-	No	-

状态	分析项目	内容
已分析	1.影响性分析说明	In the Linux kernel, the following vulnerability has been resolved:KVM: x86: hyper-v: Bound the bank index when querying sparse banksWhen checking if a VP ID is included in a sparse bank set, explicitly checkthat the ID can actually be contained in a sparse bank (the TLFS allows fora maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLBflush for L2, the VP ID is copied verbatim from the enlightened VMCS,without any bounds check, i.e. isn't guaranteed to be under the limit of4096.Failure to check the bounds of the VP ID leads to an out-of-bounds readwhen testing the sparse bank, and super strictly speaking could lead to KVMperforming an unnecessary TLB flush for an L2 vCPU. ================================================================== BUG: KASAN: use-after-free in hv_is_vp_in_sparse_set+0x85/0x100 [kvm] Read of size 8 at addr ffff88811ba5f598 by task hyperv_evmcs/2802 CPU: 12 UID: 1000 PID: 2802 Comm: hyperv_evmcs Not tainted 7.1.0-rc2 #7 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x51/0x60 print_report+0xcb/0x5d0 kasan_report+0xb4/0xe0 kasan_check_range+0x35/0x1b0 hv_is_vp_in_sparse_set+0x85/0x100 [kvm] kvm_hv_flush_tlb+0xe9e/0x16c0 [kvm] kvm_hv_hypercall+0xe6b/0x1e60 [kvm] vmx_handle_exit+0x485/0x1b60 [kvm_intel] kvm_arch_vcpu_ioctl_run+0x22e3/0x5070 [kvm] kvm_vcpu_ioctl+0x5d0/0x10c0 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0xb9/0xcf0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f0e62d1a9bf </TASK> The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x11ba5f flags: 0x4000000000000000(zone=1) raw: 4000000000000000 0000000000000000 00000000ffffffff 0000000000000000 raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88811ba5f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88811ba5f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88811ba5f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taintOpportunistically add a compile time assertion to ensure the maximum numberof sparse banks exactly matches the number of possible bits in the passedin mask.[sean: add KASAN splat, drop comment, add assert, massage changelog]The Linux kernel CVE team has assigned CVE-2026-64247 to this issue.
已分析	2.openEulerScore	8.4
已分析	3.openEulerVector	AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
已分析	4.受影响版本排查	master:不受影响,openEuler-20.03-LTS-SP4:不受影响,openEuler-22.03-LTS-SP4:不受影响,openEuler-24.03-LTS-Next:不受影响,openEuler-24.03-LTS-SP1:受影响,openEuler-24.03-LTS-SP3:受影响,openEuler-24.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP3:受影响,openEuler-24.03-LTS:受影响,openEuler-24.03-LTS-SP2:受影响
已分析	5.是否涉及abi变化	master:否,openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP4:否,openEuler-24.03-LTS-Next:否,openEuler-24.03-LTS-SP1:否,openEuler-24.03-LTS-SP3:否,openEuler-24.03-LTS-SP4:否,openEuler-22.03-LTS-SP3:否,openEuler-24.03-LTS:否,openEuler-24.03-LTS-SP2:否
已分析	6.原因说明	master:不受影响-漏洞代码不能被攻击者触发,openEuler-20.03-LTS-SP4:不受影响-漏洞代码不存在,openEuler-22.03-LTS-SP4:不受影响-漏洞代码不存在,openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发,openEuler-24.03-LTS-SP1:正常修复,openEuler-24.03-LTS-SP3:正常修复,openEuler-24.03-LTS-SP4:正常修复,openEuler-22.03-LTS-SP3:不修复-超出修复范围,openEuler-24.03-LTS:不修复-超出修复范围,openEuler-24.03-LTS-SP2:不修复-超出修复范围

Welcome To openEuler Community

Bot Usage Manual

Contact Guide