CVE-2026-64288 Details
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet (no pseudo-TLB allocated). Similarly, the TLB might be invalid, and the invalidation should be skipped in this case. Both kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() are expected to perform the same checks, except that the latter doesn't check for the allocation and blindly dereferences the pointer. Solve this by introducing a new iterator built on top of the usual kvm_for_each_vcpu() that checks for both of the above conditions, and convert the two users to it.
A vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) module for arm64 architecture has been addressed. The issue involved improper handling of VNCR (Virtual Non-Cacheable Read) TLB (Translation Lookaside Buffer) invalidation, which can occur through MMU (Memory Management Unit) notifiers or TLBI (Translation Lookaside Buffer Invalidation) instructions. These processes can conflict with a virtual CPU (vCPU) that has not yet been activated, leading to a null pointer dereference. The vulnerability arose because the existing invalidation functions did not properly check whether the pseudo-TLB was allocated or if it was valid, allowing for potential crashes or undefined behavior.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/4be6cbeb93d26994bd1827ddbce391e3c4395c8f | kernel.org | Patch |
| https://git.kernel.org/stable/c/5fd30133af864a1de0a0bd87d3fe3cf23205fbc7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7c73a269a880b1399baacfb9d521415e6ef7ecc2 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.16, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 13, 2026 | Initial Analysis | [email protected] |
| Jul 25, 2026 | New CVE Received | kernel.org |