In the Linux kernel, the following vulnerability has been resolved:
arm64: tlb: Flush walk cache when unsharing PMD tables
When huge_pmd_unshare() is called to unshare a PMD table, the
tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true
but the aarch64 tlb_flush() only checked tlb->freed_tables to
determine whether to use TLBF_NONE (vae1is, invalidates walk
cache) or TLBF_NOWALKCACHE (vale1is, leaf-only).
This caused the stale PMD page table entry to remain in the walk cache
after unshare, potentially leading to incorrect page table walks.
Fix by including unshared_tables in the check, so that when
unsharing tables, TLBF_NONE is used and the walk cache is properly
invalidated.
Here is the detailed distinction between vae1is and vale1is:
| Instruction Combination | Actual Invalidation Scope |
| ------------------------ | --------------------------------------------------|
| `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) |
| `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 |
| `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) |
| `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |
References
Configurations
Configuration 1 (hide)
|
History
30 Oct 2026, 14:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/0199c9d57861f17b556b6cba1f765c7cce79745b - Patch | |
| References | () https://git.kernel.org/stable/c/47490bbb05c8c0e09cc3cfd237d8934ffc340583 - Patch | |
| References | () https://git.kernel.org/stable/c/48125cd9c55cbe297b59fd1f9bda48b0960bd181 - Patch | |
| References | () https://git.kernel.org/stable/c/8ca7284da0e67b3e71d90ec17f08286774245ad9 - Patch | |
| References | () https://git.kernel.org/stable/c/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971 - Patch | |
| References | () https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd - Patch | |
| References | () https://git.kernel.org/stable/c/dced308d7d6a0de1c09d2058f38f1aaaf5cbb914 - Patch | |
| References | () https://git.kernel.org/stable/c/fe93e907b1af03cc229a80aa64a570a103d2b279 - Patch | |
| CWE | CWE-670 | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:* |
19 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-459 |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-30 14:57
NVD link : CVE-2026-63875
Mitre link : CVE-2026-63875
CVE.ORG link : CVE-2026-63875
JSON object : View
Products Affected
linux
- linux_kernel