CVE-2026-64288: Linux Kernel Race Condition Vulnerability

CVE-2026-64288 Overview

CVE-2026-64288 is a NULL pointer dereference vulnerability in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for the arm64 architecture. The flaw resides in the Nested Virtualization (nv) code path that handles Virtual Nested Control Register (VNCR) pseudo-Translation Lookaside Buffer (TLB) invalidation. VNCR TLB invalidations triggered by Memory Management Unit (MMU) notifiers or TLB Invalidate (TLBI) instructions can race against a virtual CPU (vCPU) that has not yet been onlined and therefore has no pseudo-TLB allocated. The function kvm_invalidate_vncr_va() dereferences the pseudo-TLB pointer without checking allocation state, leading to a kernel NULL pointer dereference.

Critical Impact
A race between VNCR TLB invalidation and vCPU onlining causes the arm64 KVM host kernel to dereference a NULL pseudo-TLB pointer, resulting in a kernel crash and denial of service on hosts running nested arm64 virtualization.

Affected Products

Linux kernel arm64 KVM subsystem with nested virtualization (arch/arm64/kvm/nested) enabled
Stable kernel branches prior to the commits 4be6cbeb, 5fd30133, and 7c73a269
arm64 hypervisor hosts exposing nested VNCR functionality to guest VMs

Discovery Timeline

2026-07-25 - CVE-2026-64288 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64288

Vulnerability Analysis

The vulnerability affects the arm64 nested virtualization path in KVM, which emulates VNCR pseudo-TLB structures for guest hypervisors. Two invalidation entry points exist: kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va(). Both are invoked when MMU notifiers fire or when a guest issues TLBI instructions. Both functions are expected to iterate over vCPUs and skip any vCPU whose pseudo-TLB has not been allocated or whose TLB entry is marked invalid.

The implementations diverged. kvm_invalidate_vncr_ipa() performs the allocation and validity checks correctly. kvm_invalidate_vncr_va() skips the allocation check and dereferences the pseudo-TLB pointer directly. When invalidation races a vCPU that has been created but not yet onlined, the pseudo-TLB pointer is NULL, and the dereference crashes the host kernel [CWE-476].

Root Cause

The root cause is an inconsistent precondition check between two sibling functions that iterate over vCPUs. Because vCPU onlining is not synchronized with MMU notifier callbacks or guest-triggered TLBI paths, the pseudo-TLB allocation state can transition mid-iteration. The fix introduces a new iterator built on kvm_for_each_vcpu() that centralizes both the allocation and TLB-validity checks, then converts both invalidation callers to use it.

Attack Vector

A local attacker with the ability to run a nested guest on an affected arm64 KVM host can trigger the race by inducing MMU notifier activity or by issuing TLBI instructions from the guest while vCPUs are being brought online. Successful triggering results in a host kernel oops and denial of service. Exploitation requires local access on the host or control of a guest VM configured for nested virtualization.

No verified public proof-of-concept code is available. See the upstream commits 4be6cbeb, 5fd30133, and 7c73a269 for the exact source-level fix.

Detection Methods for CVE-2026-64288

Indicators of Compromise

Kernel oops or panic messages referencing kvm_invalidate_vncr_va in the call stack on arm64 hosts
NULL pointer dereference entries in dmesg or journalctl -k originating from the KVM arm64 nested code path
Unexpected host crashes correlated with guest vCPU hotplug events or heavy guest TLBI activity

Detection Strategies

Monitor kernel logs on arm64 KVM hosts for oops signatures containing vncr, kvm_invalidate_vncr_va, or nested KVM symbols
Inventory arm64 hosts and confirm kernel versions against the fix commits 4be6cbeb, 5fd30133, and 7c73a269
Correlate host reboots with guest activity timelines to identify race-triggered crashes rather than hardware faults

Monitoring Recommendations

Ingest dmesg and /var/log/kern.log from arm64 KVM hosts into a centralized log platform and alert on BUG: or Oops: events referencing KVM nested symbols
Track host availability metrics for arm64 hypervisors running nested guests and investigate unplanned reboots
Enable kdump on affected hosts so crash dumps are retained for post-incident triage

How to Mitigate CVE-2026-64288

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 4be6cbeb93d2, 5fd30133af86, and 7c73a269a880 or update to a stable release that includes them
Restrict who can create nested guest VMs on arm64 KVM hosts until patched kernels are deployed
Ensure kdump is configured on production arm64 hypervisors to capture forensic data if a crash occurs

Patch Information

The fix is available in the upstream Linux kernel via the following commits: Kernel Git Commit 4be6cbeb, Kernel Git Commit 5fd30133, and Kernel Git Commit 7c73a269. The patch introduces a new iterator that consolidates the allocation and TLB-validity checks and updates both kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() to use it. Distribution kernel maintainers typically backport these fixes to supported stable branches, so verify vendor kernel changelogs before deploying.

Workarounds

Disable nested virtualization on arm64 KVM hosts by unloading the kvm module with nested support off or by setting the arm64 KVM nested parameter to 0 where supported
Prevent untrusted tenants from launching nested guests until patches are applied
Limit guest vCPU hotplug operations on production workloads to reduce the race window

bash

# Verify running kernel version and check for the fix
uname -r

# Disable nested KVM on arm64 until patched (reboot required)
echo 'options kvm-arm nested=0' | sudo tee /etc/modprobe.d/kvm-arm-nested.conf

# Confirm kdump is enabled to capture any crash while patching is scheduled
systemctl status kdump