PT-2026-61192 · Linux · Linux

CVE-2026-63875 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

arm64: tlb: Flush walk cache when unsharing PMD tables

When huge pmd unshare() is called to unshare a PMD table, the tlb unshare pmd ptdesc() function sets tlb->unshared tables=true but the aarch64 tlb flush() only checked tlb->freed tables to determine whether to use TLBF NONE (vae1is, invalidates walk cache) or TLBF NOWALKCACHE (vale1is, leaf-only).

This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks.

Fix by including unshared tables in the check, so that when unsharing tables, TLBF NONE is used and the walk cache is properly invalidated.

Here is the detailed distinction between vae1is and vale1is:

Instruction Combination	Actual Invalidation Scope
VAE1IS + TTL=0	All entries at all levels (full invalidation)
VAE1IS + TTL=2 (L2)	Non-leaf at Level 0/1 + leaf at Level 2
VALE1IS + TTL=0	Leaf entries at all levels (non-leaf not cleared)
VALE1IS + TTL=2 (L2)	Leaf entry at Level 2 only

Fix

Related Identifiers

CVE-2026-63875

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63875 · Security Note
• https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd · Note
• https://git.kernel.org/stable/c/47490bbb05c8c0e09cc3cfd237d8934ffc340583 · Note
• https://git.kernel.org/stable/c/0199c9d57861f17b556b6cba1f765c7cce79745b · Note
• https://git.kernel.org/stable/c/dced308d7d6a0de1c09d2058f38f1aaaf5cbb914 · Note
• https://git.kernel.org/stable/c/48125cd9c55cbe297b59fd1f9bda48b0960bd181 · Note
• https://git.kernel.org/stable/c/fe93e907b1af03cc229a80aa64a570a103d2b279 · Note
• https://git.kernel.org/stable/c/8ca7284da0e67b3e71d90ec17f08286774245ad9 · Note
• https://git.kernel.org/stable/c/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971 · Note