CVE-2026-63875 Overview
CVE-2026-63875 is a Linux kernel vulnerability in the arm64 Translation Lookaside Buffer (TLB) flush logic. When huge_pmd_unshare() unshares a Page Middle Directory (PMD) table, the aarch64 tlb_flush() implementation fails to invalidate the walk cache. The function checks only tlb->freed_tables and ignores the tlb->unshared_tables flag set by tlb_unshare_pmd_ptdesc(). As a result, stale PMD entries remain in the walk cache after unshare operations, leading to incorrect page table walks on ARM64 systems.
Critical Impact
A local authenticated attacker can trigger stale TLB walk cache entries to cause memory corruption, information disclosure, or privilege escalation on affected ARM64 Linux systems.
Affected Products
- Linux kernel on aarch64 (ARM64) architecture
- Kernel builds using huge page PMD sharing (huge_pmd_unshare() code path)
- Stable kernel branches prior to the fix commits referenced in kernel.org
Discovery Timeline
- 2026-07-19 - CVE-2026-63875 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63875
Vulnerability Analysis
The flaw resides in the arm64 TLB flush path invoked during huge page PMD unshare operations. When huge_pmd_unshare() releases a shared PMD table, tlb_unshare_pmd_ptdesc() sets tlb->unshared_tables=true to signal that page-table pages have been detached. However, the aarch64 tlb_flush() handler only inspected tlb->freed_tables when choosing between two invalidation instructions: VAE1IS (TLBF_NONE, invalidates walk cache and leaf entries) and VALE1IS (TLBF_NOWALKCACHE, leaf-only).
Because the unshared_tables condition was missing from the check, the kernel issued VALE1IS instead of VAE1IS. Non-leaf entries corresponding to the detached PMD table remained cached in the walk cache. Subsequent page table walks could reference the freed PMD, producing incorrect translations for user memory.
Root Cause
The root cause is an incomplete conditional in the arm64 tlb_flush() routine. The code branched on freed_tables alone rather than on the union of freed_tables and unshared_tables. This is a kernel-level logic flaw in TLB maintenance that fits the Kernel Vulnerability category and manifests as a race between page-table teardown and hardware translation caching.
Attack Vector
Exploitation requires local access with permissions to trigger huge page mapping and unmap operations, such as through hugetlbfs or shared memory mappings that invoke huge_pmd_unshare(). A local attacker orchestrates PMD sharing and unsharing to leave stale walk-cache entries, then races memory reuse to obtain translations pointing at freed page-table memory. The result is high impact to confidentiality, integrity, and availability without requiring user interaction.
No public proof-of-concept exploit code is available. See the upstream kernel commits including commit 0199c9d57861 and commit fe93e907b1af for the corrected logic.
Detection Methods for CVE-2026-63875
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing page table walks or __hugetlb_vma_unlock paths on arm64 hosts.
- Segmentation faults or memory corruption reports in processes using hugetlbfs or large shared memory regions.
- Anomalous dmesg entries indicating bad page state or freed page-table access after huge page operations.
Detection Strategies
- Inventory arm64 systems and compare running kernel versions against the fixed stable branches listed in the kernel.org commit references.
- Audit workloads that use huge pages with MAP_SHARED mappings, as these exercise the vulnerable huge_pmd_unshare() path.
- Monitor for local process activity that repeatedly creates and tears down shared huge page mappings, which is atypical for most production workloads.
Monitoring Recommendations
- Enable kernel audit logging for mmap, munmap, and shmat syscalls involving huge page flags on ARM64 endpoints.
- Aggregate kernel ring buffer messages centrally and alert on translation fault or bad PMD warnings.
- Track privileged local sessions on ARM64 servers and correlate anomalous memory allocation patterns with authentication events.
How to Mitigate CVE-2026-63875
Immediate Actions Required
- Apply the upstream Linux kernel patches from kernel.org that include unshared_tables in the arm64 tlb_flush() check.
- Update to a distribution kernel package that incorporates the fix once released by the vendor.
- Restrict local shell access on multi-tenant ARM64 hosts until patches are deployed.
Patch Information
The fix modifies the arm64 tlb_flush() logic so that both freed_tables and unshared_tables trigger use of TLBF_NONE (VAE1IS), ensuring the walk cache is properly invalidated. The corrected code is available in multiple stable branches through commits 47490bbb05c8, 48125cd9c55c, 8ca7284da0e6, c2ff4764e03e, d766a49d9b55, and dced308d7d6a.
Workarounds
- Disable or restrict hugetlbfs access for unprivileged users where operationally acceptable by tightening /proc/sys/vm/nr_hugepages and filesystem permissions.
- Limit shared huge page mappings in tenant workloads until the kernel patch is applied.
- Apply strict local access controls and least-privilege policies to reduce the pool of accounts able to trigger the vulnerable code path.
# Verify kernel version on ARM64 hosts and check for the fix
uname -m && uname -r
# Restrict hugetlbfs to a dedicated group as a hardening measure
sudo groupadd -r hugepages
sudo chgrp hugepages /dev/hugepages
sudo chmod 0770 /dev/hugepages
# After patch deployment, reboot to load the fixed kernel
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
