EUVD-2026-80518
GHSA-hcq6-hvjh-vf66
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Guest vCPU access needed (AV:L/PR:L); triggering the end-of-VA-space rollover is layout/timing dependent (AC:H); stale TLB crosses the guest/host boundary (S:C) yielding limited leak/corruption (C:L/I:L) but host DoS (A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Correctly handle end of VA space TLBI invalidation
Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction.
Each range is defined by a start and a size. However, the way the comparison is done doesn't account for address rollover, as it compares an address with (base + size). This works nicely until this expression represent the last page/block in the TTBR1 VA space, as the result is a big fat 0. And a failed TLB invalidation.
Rewrite the comparison in a way that is immune to the address rollover (making the end address inclusive instead of exclusive), and move this into a common helper that is used by both VA and IPA invalidations, as suggested by Hyunwoo Kim (although the IPA version didn't suffer from this particular problem, obviously).
AnalysisAI
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip an invalidation when the range ends at the last page or block of the TTBR1 VA space, because the exclusive end computation (base + size) wraps to zero. The faulty logic was introduced in Linux 6.16 and is fixed in 6.18.51, 7.2.5 and 7.3-rc1; hosts running unpatched kernels are exposed where a guest vCPU can drive trapped TLB-by-VA invalidations, while the IPA-invalidation path never suffered the rollover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an arm64 KVM host and attacker control of a guest vCPU capable of issuing TLB-by-VA invalidations that KVM traps and emulates (guest-level privilege, not unauthenticated). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a Linux kernel KVM/arm64 TLB-invalidation correctness bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading to Linux 6.18.51, 7.2.5 or 7.3-rc1 (or any later stable branch that contains the upstream fixes c624731ca6fe59ad8909ce4108301aa7560a91d6, 34af2c3e31f91a739dc175459fdbd99ed952b457 or ce447651a52ec077694172af10c4fffb11f56c43); kernel backport status for older long-term branches should be confirmed with the distribution vendor, whose advisories should be consulted alongside https://nvd.nist.gov/vuln/detail/CVE-2026-89918. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Arm64 host running KVM on kernel 6.16 or later and determine which are exposed to guest-driven TLB-by-VA invalidation, then prioritize patch windows for production virtualization clusters and any multi-tenant environment; suppress exposure on hosts that cannot be immediately updated by restricting untrusted guest placement and tightening which tenants may run on shared Arm nodes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations fo
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
A use-after-free race in the arm64 KVM vGICv3 code path of the Linux kernel (vgic_v3_save_pending_tables) allows a local
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today