CVE-2026-63875

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: tlb: Flush walk cache when unsharing PMD tables

When huge_pmd_unshare() is called to unshare a PMD table, the

tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true

but the aarch64 tlb_flush() only checked tlb->freed_tables to

determine whether to use TLBF_NONE (vae1is, invalidates walk

cache) or TLBF_NOWALKCACHE (vale1is, leaf-only).

This caused the stale PMD page table entry to remain in the walk cache

after unshare, potentially leading to incorrect page table walks.

Fix by including unshared_tables in the check, so that when

unsharing tables, TLBF_NONE is used and the walk cache is properly

invalidated.

Here is the detailed distinction between vae1is and vale1is:

| Instruction Combination | Actual Invalidation Scope |

| ------------------------ | --------------------------------------------------|

| `VAE1IS` + TTL=`0` | All entries at all levels (full invalidatio

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References