The vulnerability is a hardware erratum that affects certain Arm CPUs. In the Linux kernel, the TLBI;DSB sequence may complete before all memory writes translated by an invalidated TLB entry are globally observed. As a result, memory accesses that rely on the newly invalidated TLB may read stale data, leading to data corruption or unexpected behavior. The erratum does not compromise the TLB invalidation itself; it only compromises the consistency and integrity of memory for processes that depend on precise ordering.

All Linux kernel deployments running on affected Arm CPUs before the TLBI workaround is applied. This includes Arm64 builds of the Linux kernel where TLB invalidation occurs during context switches, load balancing, or memory hotplug operations. The specific CPU models are not enumerated in the CVE, but the erratum affects a range of Arm CPUs that share a common erratum number.

The risk level is moderate to low from a security standpoint. The CVSS score is not available, and the EPSS score is not published. The vulnerability is not listed in CISA's KEV catalog. Because this is a hardware erratum, remote exploitation is unlikely; the attack vector would require privileged access to the kernel or physical control. The mitigation consists of enabling the ARM64_WORKAROUND_REPEAT_TLBI workaround or applying a kernel update that includes the workaround, which adds an additional TLBI;DSB sequence after TLB invalidation to ensure global observation of memory writes.