Linux Kernel EUVD-2026-80518

Requires an arm64 KVM host and attacker control of a guest vCPU capable of issuing TLB-by-VA invalidations that KVM traps and emulates (guest-level privilege, not unauthenticated). The bug only triggers when the invalidation range lands on the last page/block of the TTBR1 VA space, so (base + size) overflows to 0 - a specific address-layout condition that limits reliable exploitation. Impact is confined to hosts running the affected code (introduced 6.16, before 6.18.51/7.2.5/7.3-rc1); the IPA-invalidation path did not suffer this rollover. This is not remotely exploitable and not triggerable without an executing guest.

This is a Linux kernel KVM/arm64 TLB-invalidation correctness bug. The vendor CVSS of 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) substantially over-states real-world risk. Three signals conflict: (1) PR:N is inconsistent with the description - the code path is KVM's handling of guest-issued TLB-by-VA invalidations, which requires an attacker to already control a guest vCPU (i.e., PR:L, authenticated within a guest), not an unauthenticated actor. (2) AC:L is questionable: the bug only manifests when a TLBI range lands on the very last page/block of the TTBR1 VA space so that (base+size) rolls over to 0 - an edge case that is layout/timing dependent to weaponize, arguing for AC:H. (3) C:H/I:H are overstated: the primary consequence is a *missed* TLB invalidation leaving stale entries, whose realistic impact is wrong translations (integrity/DoS, possibly a limited info-leak of stale data), not full confidentiality+integrity compromise. There is no KEV listing, no public POC, and no EPSS signal, so there is no evidence of active or imminent exploitation. Net: a legitimate guest→host isolation/stability bug worth patching on nested-virt-capable arm64 hosts, but far below a genuine 9.3 - my independent estimate is roughly 6.5. Note the CPE only lists generic 'linux:linux' with no version bounds; affected range must be read from the EUVD commit boundaries (introduced 6.16, fixed 6.18.51/7.2.5/7.3-rc1).

An attacker who controls a guest vCPU on an arm64 KVM host issues TLB-by-VA invalidations crafted so the target range falls on the final page/block of the TTBR1 VA space, causing KVM's range comparison to roll over and silently skip the invalidation. The resulting stale TLB entries can yield wrong address translations, undermining memory isolation and potentially corrupting state or leaking stale data across the guest/host boundary. No public exploit code is identified at time of analysis, and reliable exploitation would require precise control over VA-space layout.