CVE-2026-64282: KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Don't leak PFN when kvmtranslatevncr() races MMU notifier
In the case that kvmtranslatevncr() races with an MMU notifier the early return does not release a reference on the faulted in PFN. Add the necessary call to kvmreleasefaultinpage() for the unused PFN.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the Linux kernel fix for "KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier" by ensuring the early return in kvm_translate_vncr() calls kvm_release_faultin_page() to release the unused faulted-in PFN when kvm_translate_vncr() races with an MMU notifier.
Event History
Frequently Asked Questions
Which systems and attackers are in scope for this issue?
Systems using KVM on arm64 are the relevant exposure group. Exploitation requires local access, low privileges, and a race involving kvm_translate_vncr() and an MMU notifier; the described impact is a leaked PFN reference that can affect availability.
How can I determine whether a host is affected?
The provided data does not identify affected kernel versions or configuration conditions beyond KVM on arm64. To determine exposure, verify whether the system runs a Linux kernel containing the uncorrected KVM arm64 code and uses the affected KVM functionality.
What should I do if the issue is confirmed?
No temporary mitigation is specified in the provided data. The documented resolution is to apply a kernel update containing the change that releases the unused faulted-in PFN via kvm_release_faultin_page().