Skip to main content

Linux Kernel CVE-2026-63875

| EUVDEUVD-2026-45760 HIGH
2026-07-19 Linux GHSA-h9hg-3wv2-x6j7
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local access and a low-priv account are needed (AV:L/PR:L); reliable exploitation hinges on a narrow TLB/page-table reuse race, so AC:H; stale walks can leak and corrupt memory (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:04 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:54 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:54 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

arm64: tlb: Flush walk cache when unsharing PMD tables

When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush() only checked tlb->freed_tables to determine whether to use TLBF_NONE (vae1is, invalidates walk cache) or TLBF_NOWALKCACHE (vale1is, leaf-only).

This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks.

Fix by including unshared_tables in the check, so that when unsharing tables, TLBF_NONE is used and the walk cache is properly invalidated.

Here is the detailed distinction between vae1is and vale1is:

Instruction CombinationActual Invalidation Scope
VAE1IS + TTL=0All entries at all levels (full invalidation)
VAE1IS + TTL=2 (L2)Non-leaf at Level 0/1 + leaf at Level 2
VALE1IS + TTL=0Leaf entries at all levels (non-leaf not cleared)
VALE1IS + TTL=2 (L2)Leaf entry at Level 2 only

AnalysisAI

Stale TLB walk-cache entries in the Linux kernel on arm64 arise because huge_pmd_unshare() marks tlb->unshared_tables=true, but the aarch64 tlb_flush() logic only inspected tlb->freed_tables when deciding between a full invalidation (vae1is) and a leaf-only one (vale1is). As a result, unsharing a hugetlb PMD table leaves the obsolete PMD entry in the walk cache, allowing the MMU to perform incorrect page-table walks against freed/reassigned page-table memory - a potential path to information disclosure or memory corruption on affected 64-bit ARM systems. This is a config/architecture-specific kernel bug with no public exploit identified at time of analysis and a low EPSS (0.21%), and it is not listed in CISA KEV.

Technical ContextAI

The flaw lives in the arm64 memory-management TLB shootdown path interacting with hugetlb PMD-table sharing (the mechanism where multiple processes mapping the same shared huge-page region share a single PMD-level page table to save memory). On arm64, TLB maintenance distinguishes between VAE1IS (invalidate all cached translations for a VA, including intermediate walk-cache/table-walk entries) and VALE1IS (invalidate leaf/last-level entries only). Combined with the TTL (Translation Table Level) hint, VAE1IS with TTL=0 does a full invalidation across all levels while VALE1IS only clears leaf entries, leaving non-leaf/table-walk caches populated. When huge_pmd_unshare() detaches a shared PMD table, that PMD is itself a non-leaf structure, so a leaf-only invalidation is insufficient: the CPU's walk cache can still hold the now-stale PMD pointer. The affected products per CPE are the generic Linux kernel (cpe:2.3:a:linux:linux:*), specifically its arm64 (aarch64) MMU code; the bug is architecture-specific to ARMv8. NVD lists the CWE as N/A, but the root-cause class is effectively incorrect/insufficient cache invalidation of page-table state leading to use of stale translations (conceptually akin to CWE-367/CWE-416-adjacent stale-reference behavior in the TLB rather than a classic memory-safety bug in C code).

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your series - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, or 7.0.12/7.1 (and later), which include the change adding tlb->unshared_tables to the aarch64 tlb_flush() check so TLBF_NONE (VAE1IS) is used and the walk cache is invalidated on PMD unshare. The fix commits are available at https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd and the related stable backports listed under EUVD-2026-45760; distribution users should install their vendor's corresponding kernel errata. As this is a targeted one-line correctness fix with no documented boot-time toggle, there is no clean configuration workaround; the main compensating control is to reduce exposure of untrusted local code on arm64 hosts and, where operationally acceptable, avoid/limit shared hugetlb mappings (e.g. constrain use of MAP_SHARED huge-page regions and hugetlbfs access to trusted workloads) - noting this can materially reduce performance for HugePage-dependent applications (databases, JVM large-page setups) and is only a stopgap until the kernel is patched.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63875 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy