EUVD-2026-80511
GHSA-jq85-p2x4-26cc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Attacker needs guest vCPU execution (AV:L/PR:L), overflow is deterministic (AC:L), guest→host crossing (S:C); impact is over-invalidation → availability (A:H) with minor integrity, no real confidentiality.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Correctly cap TLBI Range to the architural limit
TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means it is pretty easy for a guest to generate an overflow should the hypervisor be naive enough to add the range to the base...
Make sure the range is capped to the limit dictated by the address bit that determines the VA range. For an IPA invalidation, this is further corrected down the line to ignore the upper range.
AnalysisAI
Host denial of service (with potential low integrity impact) in the Linux kernel's KVM/arm64 hypervisor allows a local attacker with guest execution privileges to trigger a TLB invalidation range overflow, corrupting hypervisor state. The flaw affects kernels approximately from 6.16 until the fixes in 6.18.51, 7.2.5, and 7.3-rc1, and requires the guest to issue TLB Invalidation by Range operations with an attacker-chosen virtual address. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to run and control a guest VM (vCPU execution) on a Linux arm64 host using KVM hardware virtualization; the guest must issue TLB Invalidation by Range operations with an attacker-chosen virtual address to force the uncapped range addition to overflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Vendor CVSS 7.9 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H) describes a local, low-complexity, low-privilege guest-to-host issue with a scope change and availability-dominant impact - consistent with the description: a KVM/arm64 guest issues TLB Invalidation by Range operations with an arbitrary VA that the hypervisor naively adds to a base, producing an overflow. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux 6.18.51, 7.2.5, or 7.3-rc1 (or later) to receive the patch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Arm64 Linux host running kernel versions from 6.16 up to 6.18.50 and 7.x releases prior to 7.2.5, prioritizing multi-tenant virtualization platforms and any environment where untrusted or customer-controlled guest images execute, and confirm which of those hosts run KVM. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today