CVE-2026-64288 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet (no pseudo-TLB allocated). Similarly, the TLB might be invalid, and the invalidation should be skipped in this case.
Both kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() are expected to perform the same checks, except that the latter doesn't check for the allocation and blindly dereferences the pointer.
Solve this by introducing a new iterator built on top of the usual kvm_for_each_vcpu() that checks for both of the above conditions, and convert the two users to it.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists in the Linux kernel's KVM implementation specifically targeting the arm64 architecture where the virtual nested control register pseudo-TLB handling contains a critical NULL pointer dereference flaw. The issue manifests when VNCR TLB invalidation operations occur through MMU notifiers or TLBI instructions, creating a race condition scenario where these operations may attempt to access a vcpu that has not yet been properly initialized or online. The fundamental problem lies in the inconsistent validation logic between two related functions: kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va(). While the former appropriately checks for proper allocation status before proceeding, the latter function lacks this crucial validation step and directly dereferences a potentially NULL pointer to the pseudo-TLB structure.
The race condition vulnerability stems from the timing mismatch between TLB invalidation operations and vcpu online states during system initialization or migration scenarios. When MMU notifiers or TLBI instructions trigger VNCR TLB invalidation, they may encounter a vcpu that has not yet completed its online process and therefore has no pseudo-TLB allocated to it. This creates a scenario where the kernel attempts to access memory through a NULL pointer reference, leading to potential system crashes or undefined behavior. The vulnerability specifically impacts the arm64 virtualization subsystem within KVM hypervisor implementations where nested virtualization is enabled.
The technical impact of this flaw extends beyond simple system instability to potentially enable privilege escalation or denial of service conditions within virtualized environments. When a NULL pointer dereference occurs during TLB invalidation, it can cause kernel panics that terminate the entire virtual machine or even compromise the host system's stability if the hypervisor is not properly isolated. The vulnerability affects systems running Linux kernels with KVM support and arm64 architecture where nested virtualization features are utilized, making it particularly relevant for cloud infrastructure providers and enterprise virtualization environments.
The fix addresses this issue by implementing a new iterator mechanism that builds upon the existing kvm_for_each_vcpu() framework but incorporates additional validation checks for both allocation status and online state conditions. This new iterator ensures that all TLB invalidation operations first verify whether the target vcpu has properly allocated pseudo-TLB structures before attempting any memory access operations. The solution converts both existing users of the vulnerable functions to utilize this new validated iteration approach, thereby eliminating the race condition and ensuring proper null pointer checks throughout the virtualization stack. This remediation aligns with security best practices for kernel-level memory safety and follows established patterns for preventing use-after-free and null pointer dereference vulnerabilities commonly referenced in CWE-476 (NULL Pointer Dereference) and ATT&CK techniques related to privilege escalation through kernel exploits.
The resolution maintains backward compatibility while strengthening the validation logic that governs virtual memory management operations within the KVM hypervisor. By introducing this comprehensive iterator pattern, the fix ensures consistent behavior across all TLB invalidation paths and prevents similar race conditions from occurring in other potential code paths that might not have been identified yet. This approach provides a more robust foundation for virtual memory management operations and reduces the attack surface for exploitation attempts targeting kernel memory safety vulnerabilities in virtualized environments. The implementation follows established security engineering principles by implementing defense-in-depth measures that validate all access patterns before proceeding with memory operations, making it resistant to similar timing-based race condition attacks that could potentially affect other components of the virtualization stack.