CVE-2026-64247

HIGHPre-NVD 8.48.4—
EchelonGraph scoreMEDIUM confidence

Score 8.4 from GitHub Security Advisory (severity: HIGH) published 2026-07-24. a secondary CVSS source baseline 8.4; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, secondary
Trending — 4 sources updated this week
8.4EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 8.4Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: hyper-v: Bound the bank index when querying sparse banks

When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank (the TLFS allows for a maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLB flush for L2, the VP ID is copied verbatim from the enlightened VMCS, without any bounds check, i.e. isn't guaranteed to be under the limit of

  • Failure to check the bounds of the VP ID leads to an out-of-bounds read
when testing the sparse bank, and super strictly speaking could lead to KVM performing an unnecessary TLB flush for an L2 vCPU.

================================================================== BUG: KASAN: use-after-free in hv_is_vp_in_sparse_set+0x85/0x100 [kvm] Read of size 8 at addr ffff88811ba5f598 by task hyperv_evmcs/2802

CPU: 12 UID: 1000 PID: 2802 Comm: hyperv_evmcs Not tainted 7.1.0-rc2 #7 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: dump_stack_lvl+0x51/0x60 print_report+0xcb/0x5d0 kasan_report+0xb4/0xe0 kasan_check_range+0x35/0x1b0 hv_is_vp_in_sparse_set+0x85/0x100 [kvm] kvm_hv_flush_tlb+0xe9e/0x16c0 [kvm] kvm_hv_hypercall+0xe6b/0x1e60 [kvm] vmx_handle_exit+0x485/0x1b60 [kvm_intel] kvm_arch_vcpu_ioctl_run+0x22e3/0x5070 [kvm] kvm_vcpu_ioctl+0x5d0/0x10c0 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0xb9/0xcf0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f0e62d1a9bf

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffffffffffffffff pfn:0x11ba5f flags: 0x4000000000000000(zone=1) raw: 4000000000000000 0000000000000000 00000000ffffffff 0000000000000000 raw: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff88811ba5f480: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f500: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88811ba5f580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88811ba5f600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88811ba5f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taint

Opportunistically add a compile time assertion to ensure the maximum number of sparse banks exactly matches the number of possible bits in the passed in mask.

[sean: add KASAN splat, drop comment, add assert, massage changelog]

CVSS v3
8.4
EG Score
8.4(medium)
EG Risk
42(Track)
EG Risk 42/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity84% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
2%
KEV
Not listed

Published

July 24, 2026

Last Modified

August 17, 2026

Advisory Details (5)

Auto-updated Jul 27, 2026
No patch confirmed yet.
generic

KVM: x86: hyper-v: Bound the bank index when querying sparse banks - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/f636cf6a1e7b7f40d48d8d08bd5f152aa61dd130
generic

KVM: x86: hyper-v: Bound the bank index when querying sparse banks - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/e36095d8d922bb26ce860231aacf0cd14edea07c
generic

KVM: x86: hyper-v: Bound the bank index when querying sparse banks - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/d18756b12aab30d07794446445c93112e5c69a2e
generic

KVM: x86: hyper-v: Bound the bank index when querying sparse banks - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/83c2f52c6a78b1590034e955cff3fe0b052fe4ae
generic

KVM: x86: hyper-v: Bound the bank index when querying sparse banks - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/4721f8160f17554b003e8928bb61e6c9b2fe92a3

Vendor Advisories for CVE-2026-64247(2)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(2 across 2 ecosystems)
Debian:13(1)
PackageVulnerable rangeFixed inDependents
linux6.12.38-1 ... 6.12.95-1~bpo12+1 (29 versions)6.12.95-1—
Debian:14(1)
PackageVulnerable rangeFixed inDependents
linux6.12.100-1 ... 7.1~rc7-1~exp1 (153 versions)7.1.3-1—

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Data Freshness Timeline

(refreshed 31× in last 7d / 144× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

Showing the most recent 100 of 172 total refreshes for this CVE.

  1. 2026-08-30 00:18 UTCEG score recompute
  2. 2026-08-30 00:18 UTCVendor advisory
  3. 2026-08-30 00:17 UTCGHSA enrichment
  4. 2026-08-28 21:42 UTCEPSS rescore
  5. 2026-08-28 01:29 UTCEG score recompute
  6. 2026-08-28 01:29 UTCVendor advisory
  7. 2026-08-28 01:29 UTCGHSA enrichment
  8. 2026-08-27 12:58 UTCVendor advisory
  9. 2026-08-27 12:58 UTCGHSA enrichment
  10. 2026-08-27 01:26 UTCEG score recompute
  11. 2026-08-27 01:26 UTCVendor advisory
  12. 2026-08-27 01:26 UTCGHSA enrichment
  13. 2026-08-26 14:47 UTCEPSS rescore
  14. 2026-08-26 13:55 UTCVendor advisory
  15. 2026-08-26 13:55 UTCGHSA enrichment
  16. 2026-08-26 02:23 UTCVendor advisory
  17. 2026-08-26 02:23 UTCGHSA enrichment
  18. 2026-08-25 14:51 UTCEG score recompute
  19. 2026-08-25 14:51 UTCVendor advisory
  20. 2026-08-25 14:51 UTCGHSA enrichment
  21. 2026-08-25 13:49 UTCEPSS rescore
  22. 2026-08-25 03:19 UTCVendor advisory
  23. 2026-08-25 03:19 UTCGHSA enrichment
  24. 2026-08-24 15:48 UTCEG score recompute
  25. 2026-08-24 15:48 UTCVendor advisory
Show 75 more
  1. 2026-08-24 15:48 UTCGHSA enrichment
  2. 2026-08-24 04:06 UTCEG score recompute
  3. 2026-08-24 04:06 UTCVendor advisory
  4. 2026-08-24 04:06 UTCGHSA enrichment
  5. 2026-08-23 16:34 UTCVendor advisory
  6. 2026-08-23 16:34 UTCGHSA enrichment
  7. 2026-08-23 05:03 UTCEG score recompute
  8. 2026-08-23 05:03 UTCVendor advisory
  9. 2026-08-23 05:03 UTCGHSA enrichment
  10. 2026-08-23 00:19 UTCEPSS rescore
  11. 2026-08-22 17:31 UTCVendor advisory
  12. 2026-08-22 17:31 UTCGHSA enrichment
  13. 2026-08-22 05:59 UTCEG score recompute
  14. 2026-08-22 05:59 UTCVendor advisory
  15. 2026-08-22 05:59 UTCGHSA enrichment
  16. 2026-08-21 23:49 UTCEPSS rescore
  17. 2026-08-21 18:27 UTCGHSA enrichment
  18. 2026-08-21 06:55 UTCEG score recompute
  19. 2026-08-21 06:55 UTCVendor advisory
  20. 2026-08-21 06:55 UTCGHSA enrichment
  21. 2026-08-20 22:55 UTCEPSS rescore
  22. 2026-08-20 19:21 UTCVendor advisory
  23. 2026-08-20 19:21 UTCGHSA enrichment
  24. 2026-08-20 07:49 UTCVendor advisory
  25. 2026-08-20 07:49 UTCGHSA enrichment
  26. 2026-08-19 20:18 UTCEG score recompute
  27. 2026-08-19 20:18 UTCVendor advisory
  28. 2026-08-19 20:18 UTCGHSA enrichment
  29. 2026-08-19 17:04 UTCEPSS rescore
  30. 2026-08-19 06:28 UTCVendor advisory
  31. 2026-08-19 06:28 UTCGHSA enrichment
  32. 2026-08-18 18:52 UTCEG score recompute
  33. 2026-08-18 18:52 UTCVendor advisory
  34. 2026-08-18 18:52 UTCGHSA enrichment
  35. 2026-08-18 13:48 UTCEPSS rescore
  36. 2026-08-18 04:24 UTCGHSA enrichment
  37. 2026-08-17 16:53 UTCEG score recompute
  38. 2026-08-17 16:53 UTCVendor advisory
  39. 2026-08-17 16:53 UTCGHSA enrichment
  40. 2026-08-17 13:47 UTCEPSS rescore
  41. 2026-08-17 05:22 UTCEG score recompute
  42. 2026-08-17 05:22 UTCVendor advisory
  43. 2026-08-17 05:22 UTCGHSA enrichment
  44. 2026-08-17 03:25 UTCVendor advisory
  45. 2026-08-17 03:25 UTCGHSA enrichment
  46. 2026-08-16 15:53 UTCEG score recompute
  47. 2026-08-16 15:53 UTCVendor advisory
  48. 2026-08-16 15:53 UTCGHSA enrichment
  49. 2026-08-16 14:56 UTCEPSS rescore
  50. 2026-08-16 04:21 UTCEG score recompute
  51. 2026-08-16 04:21 UTCVendor advisory
  52. 2026-08-16 04:21 UTCGHSA enrichment
  53. 2026-08-15 16:50 UTCVendor advisory
  54. 2026-08-15 16:50 UTCGHSA enrichment
  55. 2026-08-15 05:18 UTCEG score recompute
  56. 2026-08-15 05:18 UTCVendor advisory
  57. 2026-08-15 05:18 UTCGHSA enrichment
  58. 2026-08-15 01:30 UTCEPSS rescore
  59. 2026-08-14 17:46 UTCGHSA enrichment
  60. 2026-08-14 06:02 UTCEG score recompute
  61. 2026-08-14 06:02 UTCGHSA enrichment
  62. 2026-08-13 22:00 UTCEPSS rescore
  63. 2026-08-13 18:30 UTCEG score recompute
  64. 2026-08-13 18:30 UTCGHSA enrichment
  65. 2026-08-13 17:13 UTCGHSA enrichment
  66. 2026-08-13 05:41 UTCGHSA enrichment
  67. 2026-08-12 18:09 UTCEG score recompute
  68. 2026-08-12 18:09 UTCGHSA enrichment
  69. 2026-08-12 13:51 UTCEPSS rescore
  70. 2026-08-12 06:38 UTCGHSA enrichment
  71. 2026-08-11 19:06 UTCEG score recompute
  72. 2026-08-11 19:06 UTCGHSA enrichment
  73. 2026-08-11 07:34 UTCEG score recompute
  74. 2026-08-11 07:34 UTCGHSA enrichment
  75. 2026-08-11 00:00 UTCEPSS rescore

Related CVEs(same vendor + same CWE)

Frequently asked(5)

What is CVE-2026-64247?
CVE-2026-64247 is a high vulnerability published on July 24, 2026. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank (the TLFS allows for a maximum of…
When was CVE-2026-64247 disclosed?
CVE-2026-64247 was first published in the National Vulnerability Database on July 24, 2026, with the most recent update on August 17, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-64247 actively exploited?
CVE-2026-64247 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 98.4% of all scored CVEs.
What is the CVSS score of CVE-2026-64247?
CVE-2026-64247 has a CVSS v3 base score of 8.4 (NVD).
How do I remediate CVE-2026-64247?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-64247, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-64247

Explore →

Is Your Infrastructure Affected by CVE-2026-64247?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs