{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-63875 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-63875 is a high-severity vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-63875 and fix it if it is affected.\n\nWhat it is: CVE-2026-63875 is a high-severity vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-63875 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-63875/ (Markdown: https://insights.sbomify.com/CVE-2026-63875/index.md)","id":"CVE-2026-63875","markdown":"https://insights.sbomify.com/CVE-2026-63875/index.md","name":"CVE-2026-63875","record":{"aliases":["BELL-CVE-2026-63875","DEBIAN-CVE-2026-63875","GHSA-h9hg-3wv2-x6j7","ROOT-OS-UBUNTU-2204-CVE-2026-63875","UBUNTU-CVE-2026-63875"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["other"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A missing TLB walk cache flush in the Linux kernel arm64 subsystem could lead to incorrect page table walks and potential memory corruption.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-459","name":"Incomplete Cleanup"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: tlb: Flush walk cache when unsharing PMD tables\n\nWhen huge_pmd_unshare() is called to unshare a PMD table, the\ntlb_unshare_pmd_ptdesc() function sets tlb-\u003eunshared_tables=true\nbut the aarch64 tlb_flush() only checked tlb-\u003efreed_tables to\ndetermine whether to use TLBF_NONE (vae1is, invalidates walk\ncache) or TLBF_NOWALKCACHE (vale1is, leaf-only).\n\nThis caused the stale PMD page table entry to remain in the walk cache\nafter unshare, potentially leading to incorrect page table walks.\n\nFix by including unshared_tables in the check, so that when\nunsharing tables, TLBF_NONE is used and the walk cache is properly\ninvalidated.\n\nHere is the detailed distinction between vae1is and vale1is:\n\n| Instruction Combination  | Actual Invalidation Scope                         |\n| ------------------------ | --------------------------------------------------|\n| `VAE1IS`  + TTL=`0`      | All entries at all levels (full invalidation)     |\n| `VAE1IS`  + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2           |\n| `VALE1IS` + TTL=`0`      | Leaf entries at all levels (non-leaf not cleared) |\n| `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only                        |","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"arm64: tlb: Flush walk cache when unsharing PMD tables","id":"CVE-2026-63875","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"other","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"serial: zs: Convert to use a platform device","id":"CVE-2026-63876"},"packages":[],"prev":{"headline":"net: mctp: usb: fix race between urb completion and rx_retry cancellation","id":"CVE-2026-63874"},"products":["Linux"],"published":"2026-07-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A missing TLB walk cache flush in the Linux kernel arm64 subsystem could lead to incorrect page table walks and potential memory corruption.","url":"https://insights.sbomify.com/CVE-2026-63875/"}