Executive brief
The Linux kernel's KVM hypervisor for ARM64 systems had an integer overflow vulnerability in TLB (Translation Lookaside Buffer) invalidation range handling. A guest virtual machine could craft malicious invalidation requests that overflow memory calculations, allowing the guest to corrupt hypervisor memory or cause system crashes, compromising the isolation between virtual machines.
Technical details
The vulnerability is an integer overflow in KVM's nested virtualization support for ARM64 (arch/arm64/include/asm/kvm_nested.h). The decode_range_tlbi() function failed to properly cap the TLB invalidation range to architectural limits when processing guest-supplied range-based TLBI instructions. An attacker controlling a guest VM could specify a TLB invalidation range with an arbitrary base address that, when added to the calculated range, overflows the 48-bit address space limit. The fix adds explicit bounds checking to cap the calculated range to either (BIT(48) - base) or (~base + 1) depending on which half of the address space the base address falls in. No user interaction or special privileges are required beyond VM execution; a standard guest OS or malicious workload can trigger this.
Affected products
- Linux Linux kernel Affected versions across multiple kernel series from linux-2.6.x through linux-7.x (specific impacted versions not clearly delineated in advisory)
Timeline
- 2026-09-16: disclosed
- 2026-09-11: patched: Fix committed to stable kernel trees