CVE-2026-63875 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
arm64: tlb: Flush walk cache when unsharing PMD tables
When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush() only checked tlb->freed_tables to determine whether to use TLBF_NONE (vae1is, invalidates walk cache) or TLBF_NOWALKCACHE (vale1is, leaf-only).
This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks.
Fix by including unshared_tables in the check, so that when unsharing tables, TLBF_NONE is used and the walk cache is properly invalidated.
Here is the detailed distinction between vae1is and vale1is:
| Instruction Combination | Actual Invalidation Scope | | ------------------------ | --------------------------------------------------| | `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) | | `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 | | `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) | | `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within the arm64 architecture implementation of the Linux kernel's translation lookaside buffer management system. The issue stems from an incomplete check during the TLB flushing process when unsharing PMD tables through the huge_pmd_unshare() function. When this function operates, it correctly sets the tlb->unshared_tables=true flag to indicate that table unsharing has occurred. However, the aarch64 tlb_flush() implementation fails to consider this flag during its decision-making process for which TLB invalidation instruction to use.
The technical flaw manifests in the conditional logic that determines whether to apply TLBF_NONE or TLBF_NOWALKCACHE instructions during TLB flushing operations. The current implementation only examines the tlb->freed_tables flag but ignores the tlb->unshared_tables indicator. This oversight results in an improper choice of invalidation scope where the system incorrectly applies TLBF_NOWALKCACHE instead of TLBF_NONE when unsharing PMD tables. The distinction between these two instruction sets is critical for proper cache management, as TLBF_NONE uses VAE1IS with TTL=0 which performs complete invalidation including walk cache entries, while TLBF_NOWALKCACHE employs VALE1IS with TTL=0 which only clears leaf entries without touching the walk cache.
This vulnerability creates a potential security risk by allowing stale page table entries to persist in the walk cache after unsharing operations. The persistence of these outdated entries can lead to incorrect page table walks during subsequent memory access operations, potentially enabling information disclosure or privilege escalation attacks. The flaw specifically affects systems utilizing huge pages and PMD (Page Middle Directory) table structures where memory management operations involve unsharing page table entries.
The operational impact of this vulnerability extends beyond simple performance degradation to potential security implications within memory management subsystems. When the walk cache retains stale PMD entries, it can cause memory access violations or incorrect address translations that may be exploited by malicious actors to bypass memory protection mechanisms. The issue particularly affects systems where memory sharing and unsharing operations occur frequently, such as in virtualized environments or systems with dynamic memory allocation patterns.
The fix implemented addresses this vulnerability by extending the conditional check within the aarch64 tlb_flush() function to include the tlb->unshared_tables flag alongside the existing tlb->freed_tables examination. This modification ensures that when PMD table unsharing operations occur, the system properly selects TLBF_NONE invalidation instruction which correctly invalidates the walk cache entries. The solution aligns with established security practices for memory management and follows the principle of least privilege by ensuring complete invalidation of affected cache entries during critical memory operations. This remediation directly addresses the underlying issue identified in CWE-1237, which relates to improper handling of memory management operations in kernel space, and mitigates potential attack vectors categorized under ATT&CK technique T1068 for privilege escalation through local system exploitation.
The fix demonstrates proper adherence to memory management best practices by ensuring complete cache invalidation during critical page table operations. This approach prevents the retention of stale entries that could be exploited in subsequent memory access operations, thereby maintaining the integrity of the virtual memory subsystem and protecting against potential information disclosure vulnerabilities. The implementation follows established patterns for TLB management in ARM64 architectures while maintaining compatibility with existing kernel functionality and performance characteristics.