Executive brief
A vulnerability was identified in the Linux kernel's virtualization component (KVM) for ARM64 systems. It occurs when the system attempts to clear memory address caches for virtual machines that are not yet fully initialized. This can lead to a system crash (kernel panic), potentially causing a denial of service for the host and all hosted virtual machines.
Technical details
A NULL pointer dereference exists in the KVM arm64 nested virtualization (NV) implementation within arch/arm64/kvm/nested.c. The functions kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() can race against a vCPU that has not yet been onlined, resulting in an unallocated pseudo-TLB. While the IPA invalidation function contained a check, the VA invalidation function (kvm_invalidate_vncr_va) blindly dereferenced the VNCR pointer. An attacker with sufficient privileges to trigger MMU notifiers or TLBI instructions could exploit this race condition to cause a kernel panic. The fix introduces a new iterator, kvm_for_each_vncr_tlb, which ensures the pseudo-TLB is both allocated and valid before dereferencing.
Affected products
- Linux Linux Kernel 6.16 to 6.18.39, 7.1.4
Timeline
- 2026-06-07: other: Initial patch authored by Marc Zyngier
- 2026-07-25: disclosed: CVE published