EUVD-2026-80514
GHSA-qcff-3h48-22j7
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Guest-context local vector (AV:L), deterministic (AC:L), requires vCPU control so PR:L not PR:N; guest→host is S:C; DoS-dominant (A:H) with bounded integrity (I:L) and no clear confidentiality loss.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Sign-extend VA for range-based TLBI invalidation
When the decode_range_tlbi() helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it.
As a result, special care must be taken to not overflow PA bits when this is used for S2 invalidation.
AnalysisAI
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range because the decode_range_tlbi() helper omitted the required virtual-address sign-extension when it was reused for stage-1 TLBI handling, and the same helper can overflow physical-address bits when invoked for stage-2 invalidation. Only arm64 hosts running KVM are affected, and the attacker must already control a guest VM/vCPU able to issue range-based TLBI operations (low-privilege guest context, no user interaction, no network reachability); kernels from the 6.16 introduction through the fixes in 6.18.51, 7.2.5 and 7.3-rc1 are in scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the host to be running arm64 KVM virtualization AND the attacker to control a guest VM/vCPU capable of issuing range-based TLBI operations (this is the privilege that makes PR:L, not PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a Linux kernel KVM/arm64 hypervisor bug: decode_range_tlbi() was reused for stage-1 (S1) TLBI handling but omitted the VA sign-extension, so range-based TLB invalidation is computed against the wrong VA range, and stage-2 (S2) use of the same helper can overflow PA bits. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.18.51, 7.2.5, or 7.3-rc1 (or apply the stable commits 72bce82c4171bf330919ff1b64dc0a36c254ec7d, 3feb83918e30f0472e058224b926ebfe8a064fac and 2393470085649f0b973ecceb26fe8fc71edde0c1 from https://git.kernel.org/stable/c/72bce82c4171bf330919ff1b64dc0a36c254ec7d, https://git.kernel.org/stable/c/3feb83918e30f0472e058224b926ebfe8a064fac and https://git.kernel.org/stable/c/2393470085649f0b973ecceb26fe8fc71edde0c1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all arm64 Linux hosts running KVM and identify kernel versions from 6.16 through the pre-fix releases; restrict creation or operation of untrusted guest VMs/vCPUs that can issue range-based TLBI operations where operationally feasible, and begin maintenance planning for vendor-released patch versions 6.18.51, 7.2.5, and 7.3-rc1. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
A use-after-free race in the arm64 KVM vGICv3 code path of the Linux kernel (vgic_v3_save_pending_tables) allows a local
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today