Executive brief
The Linux kernel's KVM hypervisor for ARM64 processors contains a race condition in its virtual nested configuration register (VNCR) TLB invalidation logic. When one virtual CPU is translating a VNCR address while another CPU invalidates the underlying page table entry, stale TLB entries can be inserted, potentially allowing guest code to access invalid memory regions. This affects systems running virtualized ARM64 workloads and could enable guest escape or memory corruption attacks.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in the KVM arm64 nested virtualization code. The root cause is that during VNCR translation, one vCPU can walk the stage-1 page tables and insert a TLB entry for a VNCR address after another vCPU has invalidated that entry via TLBI S1E2, resulting in a stale mapping. The fix extends the invalidate_vncr_va() function to bump the mmu_invalidate_seq counter when invalidating, and ensures that kvm_translate_vncr() samples this sequence number before—not after—walking the page tables. This allows parallel faults to detect invalidations and retry. The vulnerability exists in the ARM64 KVM nested virtualization (NV) code path affecting hosts that support nested hypervisor functionality (NV2 feature required).
Affected products
- Linux Linux kernel 5.0 and later (KVM arm64 module with NV support)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-08-06: patched: Fix authored by Marc Zyngier in upstream commit 2b7324f3a0c1072b9d578b8d42f199506753f26e
- 2026-09-11: patched: Backported to stable kernel trees