Executive brief
A technical issue was identified in the Linux kernel for ARM64 systems where the system's memory management unit might not properly clear old data when reconfiguring memory tables. This could lead to the system using outdated memory mapping information, potentially causing stability issues or incorrect data processing. The vulnerability has been resolved in recent kernel updates.
Technical details
A vulnerability in the arm64 TLB flushing logic occurred because the tlb_flush() function only checked the freed_tables flag and ignored the unshared_tables flag. When huge_pmd_unshare() is called, the walk cache was not properly invalidated because the system incorrectly used leaf-only invalidation (vale1is) instead of full invalidation (vae1is). This results in stale PMD entries remaining in the walk cache, which can lead to incorrect page table walks. The fix ensures that both freed and unshared tables trigger a proper walk cache invalidation.
Affected products
- Linux Linux arm64 architecture
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/0199c9d57861f17b556b6cba1f765c7cce79745b
- https://git.kernel.org/stable/c/47490bbb05c8c0e09cc3cfd237d8934ffc340583
- https://git.kernel.org/stable/c/48125cd9c55cbe297b59fd1f9bda48b0960bd181
- https://git.kernel.org/stable/c/8ca7284da0e67b3e71d90ec17f08286774245ad9
- https://git.kernel.org/stable/c/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971
- https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd
- https://git.kernel.org/stable/c/dced308d7d6a0de1c09d2058f38f1aaaf5cbb914