CVE-2026-64288

CVE CVE-2026-64288EUVD EUVD-2026-49000Published 2026-07-25T08:49:28.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet (no pseudo-TLB allocated). Similarly, the TLB might be invalid, and the invalidation should be skipped in this case. Both kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() are expected to perform the same checks, except that the latter doesn't check for the allocation and blindly dereferences the pointer. Solve this by introducing a new iterator built on top of the usual kvm_for_each_vcpu() that checks for both of the above conditions, and convert the two users to it.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 0; 6.16; patch: 7.1.4; patch: 7.2-rc1; 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 <4be6cbeb93d26994bd1827ddbce391e3c4395c8f; 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 <5fd30133af864a1de0a0bd87d3fe3cf23205fbc7; patch: 6.18.39; 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 <7c73a269a880b1399baacfb9d521415e6ef7ecc2

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.