Executive brief
The Linux kernel's ARM64 KVM hypervisor contains a race condition in VNCR (Virtual Nested Configuration Register) TLB invalidation handling. Concurrent execution paths between memory unmapping operations and TLB invalidation can cause kernel crashes (BUG_ON failures) or memory corruption. This affects systems using nested virtualization on ARM64 platforms where multiple virtual CPUs interact with shared memory structures.
Technical details
The vulnerability is a time-of-check-to-time-of-use (TOCTOU) race in the KVM arm64 nested virtualization code, specifically in VNCR TLB invalidation. The root cause is that vncr_tlb::cpu field access is not properly synchronized between invalidate_vncr() (which holds the MMU lock) and this_cpu_reset_vncr_fixmap() (called from vcpu_put() without the MMU lock). The invalidation path checks if cpu != -1 before unmapping, while vcpu_put() unconditionally unmaps if L1_VNCR_MAPPED is set, leading to double-unmap conditions or use-after-free. The fix converts vncr_tlb::cpu to an atomic_t and introduces unmap_l1_vncr() function using atomic_xchg_relaxed() to ensure only one thread successfully resets the field and performs the unmap, preventing concurrent manipulation of the same mapping.
Affected products
- Linux Linux kernel 5.14 and later with ARM64 KVM nested virtualization support
Timeline
- 2026-09-16: disclosed
- 2026-08-08: patched: Fix committed upstream by Oliver Upton