CVE-2026-63875
Received Received - Intake

TLBF_NONE Flush Required in Linux Kernel arm64 TLB Unshare

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush() only checked tlb->freed_tables to determine whether to use TLBF_NONE (vae1is, invalidates walk cache) or TLBF_NOWALKCACHE (vale1is, leaf-only). This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks. Fix by including unshared_tables in the check, so that when unsharing tables, TLBF_NONE is used and the walk cache is properly invalidated. Here is the detailed distinction between vae1is and vale1is: | Instruction Combination | Actual Invalidation Scope | | ------------------------ | --------------------------------------------------| | `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) | | `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 | | `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) | | `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63875
EUVD
EUVD-2026-45760

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of page table entries during unsharing of PMD tables. When a PMD table is unshared, the system fails to flush the walk cache correctly, leaving stale entries that could cause incorrect memory access during page table walks.

Detection Guidance

This vulnerability is specific to the Linux kernel's arm64 architecture and requires kernel-level inspection. Detection involves checking kernel logs for TLB flush errors or examining page table walk cache behavior. Use commands like dmesg | grep -i tlb or cat /proc/cpuinfo to verify arm64 architecture. No direct network detection commands are applicable.

Impact Analysis

This flaw could lead to memory corruption or crashes due to incorrect page table walks. Attackers might exploit it to escalate privileges or cause denial-of-service conditions by manipulating memory mappings.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a low-level Linux kernel issue related to page table management that could lead to incorrect memory access but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution to resolve the issue. Reboot the system after patching to ensure the updated kernel is active. Monitor system logs for TLB-related errors post-reboot.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart