Executive brief
KVM (Kernel Virtual Machine) on ARM64 processors uses TLB (Translation Lookaside Buffer) invalidation to manage virtual memory for guest systems. A flaw in the comparison logic fails to account for address space wraparound when invalidating TLB entries at the end of the addressable virtual memory range, causing incomplete memory invalidation. This could allow a guest virtual machine to retain access to memory regions that should have been invalidated, potentially leading to information disclosure or privilege escalation within the hypervisor.
Technical details
The vulnerability is an integer arithmetic bug in KVM's VNCR (Virtual Nested Configuration Register) TLB invalidation code on ARM64. The vulnerable code compares address ranges by computing (base + size) to determine the end boundary, which results in 0 when the expression wraps around at the end of the TTBR1 virtual address space. This causes the range comparison logic to fail, resulting in missed TLB invalidations. The fix introduces a new helper function `vncr_tlb_intersects()` that uses inclusive end addresses and rewritten comparison logic immune to address rollover. The vulnerability affects nested virtualization (NV2) features and requires the affected kernel to be running KVM with nested virtualization support enabled. A patch has been committed to the stable Linux kernel tree.
Affected products
- Linux Linux kernel Affects multiple kernel series including linux-4.x, linux-5.x, linux-6.x and later
Timeline
- 2026-09-16: disclosed
- 2026-08-08: patched: Fix committed upstream by Oliver Upton
- 2026-08-06: other: Original fix authored by Marc Zyngier