CVE-2026-64288: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet (no pseudo-TLB allocated). Similarly, the TLB might be invalid, and the invalidation should be skipped in this case.
Both kvminvalidatevncripa() and kvminvalidatevncrva() are expected to perform the same checks, except that the latter doesn't check for the allocation and blindly dereferences the pointer.
Solve this by introducing a new iterator built on top of the usual kvmforeachvcpu() that checks for both of the above conditions, and convert the two users to it.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64288?
The severity of CVE-2026-64288 is medium with a CVSS score of 5.5.
How do I fix CVE-2026-64288?
To fix CVE-2026-64288, apply the available patches provided in the Linux kernel updates.
What type of vulnerability is CVE-2026-64288?
CVE-2026-64288 is classified as a Null Pointer Dereference vulnerability.
Which software is affected by CVE-2026-64288?
CVE-2026-64288 affects the Linux kernel on the arm64 architecture.
What is the cause of CVE-2026-64288?
CVE-2026-64288 is caused by a race condition leading to a NULL dereference in the VNCR pseudo-TLB.