CVE-2026-43486

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults

contpte_ptep_set_access_flags() compared the gathered ptep_get() value

against the requested entry to detect no-ops. ptep_get() ORs AF/dirty

from all sub-PTEs in the CONT block, so a dirty sibling can make the

target appear already-dirty. When the gathered value matches entry, the

function returns 0 even though the target sub-PTE still has PTE_RDONLY

set in hardware.

For a CPU with FEAT_HAFDBS this gathered view is fine, since hardware may

set AF/dirty on any sub-PTE and CPU TLB behavior is effectively gathered

across the CONT range. But page-table walkers that evaluate each

descriptor individually (e.g. a CPU without DBM support, or an SMMU

without HTTU, or with HA/HD disabled in CD.TCR) can keep faulting on the

unchanged target sub-PTE, causing an infinite fault loop.

Gathering can therefore cause false no-ops when only a sibling has been

upda

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References