CVE-2026-64282 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
In the case that kvm_translate_vncr() races with an MMU notifier the early return does not release a reference on the faulted in PFN. Add the necessary call to kvm_release_faultin_page() for the unused PFN.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a memory management issue within the Linux kernel's KVM implementation specifically targeting the arm64 architecture. This flaw occurs during the translation process of virtual machine control registers where a race condition can manifest between the kvm_translate_vncr() function and MMU notifiers. The core problem arises when the system encounters a page fault during virtual memory translation but the early return path fails to properly clean up resources, leading to a reference leak on the Page Frame Number (PFN) that was temporarily allocated for fault handling.
The technical nature of this vulnerability stems from improper resource management within kernel space memory subsystems. When kvm_translate_vncr() executes and encounters a race with MMU notifiers, it must exit early without properly releasing the PFN that was acquired during the fault handling process. This creates a situation where the PFN reference count remains incremented even though the page is no longer needed by the translation logic, resulting in memory leak conditions that persist until the system reclaims these resources through other mechanisms.
The operational impact of this vulnerability manifests as gradual memory consumption increases within virtualized environments running on arm64 platforms. While individual leaks may appear negligible, sustained operation of virtual machines under heavy memory pressure can accumulate multiple leaked PFNs, eventually leading to memory exhaustion scenarios that affect overall system stability and performance. The issue particularly affects systems with intensive virtualization workloads where MMU notifiers are frequently invoked during memory management operations.
This vulnerability aligns with CWE-401 which addresses improper release of memory resources, specifically targeting memory leaks in kernel space operations. The flaw also relates to the ATT&CK technique T1059.006 for system binary manipulation and T1484.001 for privilege escalation through kernel exploits, though it primarily represents a resource exhaustion vector rather than direct execution capability. The fix implemented involves adding explicit calls to kvm_release_faultin_page() to ensure proper cleanup regardless of the code path taken during the race condition scenario.
The mitigation strategy focuses on correcting the reference counting logic within the KVM subsystem by ensuring that all code paths properly release PFN resources when early returns occur. This requires careful attention to synchronization mechanisms and resource management patterns within the kernel's virtualization framework. Regular system updates and patch deployment become critical for maintaining memory integrity in virtualized environments, particularly those running on arm64 architectures where this specific race condition can manifest during normal operation.
Security researchers have identified that similar issues in kernel memory management often serve as precursors to more serious exploits, making timely patching essential for maintaining system integrity. The vulnerability demonstrates the complexity of managing shared resources in virtualized environments where multiple subsystems must coordinate access to memory pages while maintaining proper reference counting mechanisms. Organizations running arm64-based virtualization infrastructure should prioritize applying relevant kernel patches to prevent potential memory exhaustion attacks that could impact service availability and system performance.
The fix implementation represents a defensive programming approach that addresses race conditions through explicit resource management rather than relying on implicit cleanup mechanisms. This approach aligns with modern kernel security practices that emphasize deterministic resource handling and proper error path management. The solution ensures that even under adverse timing conditions where MMU notifiers interrupt the normal execution flow, the system maintains proper memory accounting and prevents accumulation of leaked resources that could eventually lead to system instability or denial of service conditions.