Linux Kernel CVE-2026-64288

The vulnerability resides in the KVM hypervisor's arm64 nested virtualization (NV) subsystem, specifically in the VNCR (Virtual Nested CPU Register) pseudo-TLB invalidation logic. CWE-476 (Null Pointer Dereference) is the root cause: kvm_invalidate_vncr_va() unconditionally dereferences the VNCR pseudo-TLB pointer, which may be NULL when a vCPU has not yet been onlined - meaning no pseudo-TLB buffer has been allocated for it. TLB invalidation is triggered asynchronously by MMU notifiers or explicit TLBI instructions, creating a window where the pointer can be NULL. The companion function kvm_invalidate_vncr_ipa() already performs the required NULL and validity checks; the omission in kvm_invalidate_vncr_va() is the gap. The fix introduces a dedicated iterator over kvm_for_each_vcpu() that validates both allocation status and TLB validity before proceeding, applied consistently to both invalidation paths. CPE data (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) confirms the upstream Linux kernel as the affected product, scoped to arm64 KVM with nested virtualization support compiled in.