CVE-2026-63875 arm64: tlb: Flush walk cache when unsharing PMD tables
A missing TLB walk cache flush in the Linux kernel arm64 subsystem could lead to incorrect page table walks and potential memory corruption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63875?
CVE-2026-63875 is a high-severity vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
arm64: tlb: Flush walk cache when unsharing PMD tables
When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush() only checked tlb->freed_tables to determine whether to use TLBF_NONE (vae1is, invalidates walk cache) or TLBF_NOWALKCACHE (vale1is, leaf-only).
This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks.
Fix by including unshared_tables in the check, so that when unsharing tables, TLBF_NONE is used and the walk cache is properly invalidated.
Here is the detailed distinction between vae1is and vale1is:
| Instruction Combination | Actual Invalidation Scope | | ------------------------ | --------------------------------------------------| | `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) | | `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 | | `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) | | `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |
Weakness: CWE-459
Which versions are affected by CVE-2026-63875?
How do I fix CVE-2026-63875?
Apply the vendor's patch.
Is CVE-2026-63875 being exploited?
There is no known exploitation of CVE-2026-63875 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63875, DEBIAN-CVE-2026-63875, GHSA-h9hg-3wv2-x6j7, ROOT-OS-UBUNTU-2204-CVE-2026-63875, UBUNTU-CVE-2026-63875.