CVE-2026-64604: Software Security Vulnerability Vulnerability

UNKNOWN

Advisory Identifier: GHSA-m98c-vhm9-hw9c

Published 2026-08-06

Advisory Summary

CVE-2026-64604 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64604 at a Glance

CVE Identifier CVE-2026-64604

GHSA Identifier GHSA-m98c-vhm9-hw9c

Severity N/A

CVSS v3.1 Base Score N/A

CWE Classification General Security Weakness

Affected Product Software

Package Ecosystem Maven

Published Date 2026-08-06

Last Updated 2026-08-06

How to Fix CVE-2026-64604

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64604, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in guest mode so that a future change can have update CR8 intercepts during vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion. ------------[ cut here ]------------ debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count)) WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879 WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879 Modules linked in: CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline] RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879 Call Trace: <TASK> apic_update_ppr arch/x86/kvm/lapic.c:984 [inline] kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023 kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986 kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847 kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201 kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> No functional change intended.

References

git.kernel.org/stable/c/9a21f1defd... WEB

https://git.kernel.org/stable/c/9a21f1defd96c6301c5fb462a78eb51b191bd2dd

NVD — CVE-2026-64604 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-64604

git.kernel.org/stable/c/258ec63c0f... WEB

https://git.kernel.org/stable/c/258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4

git.kernel.org/stable/c/3dcfb04dd4... WEB

https://git.kernel.org/stable/c/3dcfb04dd43b16fa1240fc6487fff578ad57264c

git.kernel.org/stable/c/570af5db08... WEB

https://git.kernel.org/stable/c/570af5db081b87374594a00711ac5760d2ea6844

git.kernel.org/stable/c/7ef78d71ca... WEB

https://git.kernel.org/stable/c/7ef78d71ca713d8c00f7c34ddcf276c808143f77

git.kernel.org/stable/c/c7cd360524... WEB

https://git.kernel.org/stable/c/c7cd3605244c924249dea32632e1bc3e89bda543

git.kernel.org/stable/c/db8407b9fd... WEB

https://git.kernel.org/stable/c/db8407b9fd06d857a4a5e8bcff1d086d13007711

git.kernel.org/stable/c/ffaaff8233... WEB

https://git.kernel.org/stable/c/ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a

Frequently Asked Questions

What is CVE-2026-64604?

CVE-2026-64604 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.

Which Software versions are affected?

Affected versions include releases prior to current release patches.

What version fixes CVE-2026-64604?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

What CWE is associated with CVE-2026-64604?

CVE-2026-64604 is classified under General Security Weakness.

How can I check Maven dependencies for CVE-2026-64604?

Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m98c-vhm9-hw9c",
  "modified" : "2026-08-06T09:30:33Z",
  "published" : "2026-08-06T09:30:33Z",
  "aliases" : [ "CVE-2026-64604" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode\n\nWhen updating CR8 intercepts, get vmcs12 if and only if the vCPU is in\nguest mode so that a future change can have update CR8 intercepts during\nvCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.\n\n  ------------[ cut here ]------------\n  debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))\n  WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879\n  WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879\n  Modules linked in:\n  CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n  RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]\n  RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879\n  Call Trace:\n   <TASK>\n   apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]\n   kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023\n   kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986\n   kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847\n   kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201\n   kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583\n   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   </TASK>\n\nNo functional change intended.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64604"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/258ec63c0f281bf7b50f9de67c8e93b5b7be5ed4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3dcfb04dd43b16fa1240fc6487fff578ad57264c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/570af5db081b87374594a00711ac5760d2ea6844"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7ef78d71ca713d8c00f7c34ddcf276c808143f77"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9a21f1defd96c6301c5fb462a78eb51b191bd2dd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c7cd3605244c924249dea32632e1bc3e89bda543"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/db8407b9fd06d857a4a5e8bcff1d086d13007711"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ffaaff82336db84e9b58e7a3e81c2fd64e05ed7a"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-06T08:16:36Z"
  }
}

Advisory Metadata

Source ID: GHSA-m98c-vhm9-hw9c
Schema Version: 1.4.0
Published: 2026-08-06 09:30
Last Modified: 2026-08-06 09:30
Database Record File: advisories/unreviewed/2026/08/GHSA-m98c-vhm9-hw9c/GHSA-m98c-vhm9-hw9c.json