CVE-2026-64288 - Vulnerability Details

- KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB

VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions,
and either can race against a vcpu not being onlined yet (no pseudo-TLB
allocated). Similarly, the TLB might be invalid, and the invalidation
should be skipped in this case.

Both kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() are
expected to perform the same checks, except that the latter doesn't
check for the allocation and blindly dereferences the pointer.

Solve this by introducing a new iterator built on top of the usual
kvm_for_each_vcpu() that checks for both of the above conditions,
and convert the two users to it.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the KVM arm64 NV extension can trigger a null pointer dereference when a virtual CPU is not yet online; the model that handles VNCR TLB invalidation fails to check whether the pseudo‑TLB has been allocated, potentially causing the kernel to crash and denying service to the virtual machine and host.

Affected Systems

The flaw affects the Linux kernel on ARM64 platforms that use KVM. It is present in all kernel releases prior to the commit that introduced a safe iterator for the VNCR functions; no specific version numbers are listed in the data, so any kernel build before the fix is vulnerable.

Risk and Exploitability

The EPSS score is less than 1%, indicating a low probability of real‑world exploitation. The CVSS score of 5.5 reflects a moderate impact. The vulnerability appears to be exploitable from within the host system. Based on the description, it is inferred that an attacker would need privileged access to the KVM hypervisor to trigger the null pointer dereference. The issue is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929`	affected	< 7c73a269a880b1399baacfb9d521415e6ef7ecc2
`4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929`	affected	< 5fd30133af864a1de0a0bd87d3fe3cf23205fbc7
`4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929`	affected	< 4be6cbeb93d26994bd1827ddbce391e3c4395c8f

Linux

affected

Version	Status	Constraints
`6.16`	affected	—
`0`	unaffected	< 6.16
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929,7c73a269a880b1399baacfb9d521415e6ef7ecc2)`	affected	code_commit	—
`[4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929,5fd30133af864a1de0a0bd87d3fe3cf23205fbc7)`	affected	code_commit	—
`[4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929,4be6cbeb93d26994bd1827ddbce391e3c4395c8f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.16`	affected	semver	—
`[0,6.16)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the host kernel to a release that contains the commit adding safe VNCR handling (e.g., commit 4be6cbeb…).
Rebuild the KVM module against the updated kernel source and load it into the running system.
Reboot the host to activate the patched kernel and ensure no older kernels or modules remain in use.

Generated by OpenCVE AI on August 3, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00153.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4be6cbeb93d26994bd1827ddbce391e3c4395c8f
https://git.kernel.org/stable/c/5fd30133af864a1de0a0bd87d3fe3cf23205fbc7
https://git.kernel.org/stable/c/7c73a269a880b1399baacfb9d521415e6ef7ecc2
https://lore.kernel.org/linux-cve-announce/2026072503-CVE-2026-64288-c17b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64288
https://www.cve.org/CVERecord?id=CVE-2026-64288

History

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072503-CVE-2026-64288-c17b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64288 https://www.cve.org/CVERecord?id=CVE-2026-64288
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 27 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet (no pseudo-TLB allocated). Similarly, the TLB might be invalid, and the invalidation should be skipped in this case. Both kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() are expected to perform the same checks, except that the latter doesn't check for the allocation and blindly dereferences the pointer. Solve this by introducing a new iterator built on top of the usual kvm_for_each_vcpu() that checks for both of the above conditions, and convert the two users to it.
Title		KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4be6cbeb93d26994bd1827ddbce391e3c4395c8f https://git.kernel.org/stable/c/5fd30133af864a1de0a0bd87d3fe3cf23205fbc7 https://git.kernel.org/stable/c/7c73a269a880b1399baacfb9d521415e6ef7ecc2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:28.789Z

Updated: 2026-07-25T08:49:28.789Z

Reserved: 2026-07-19T15:36:31.778Z

Link: CVE-2026-64288

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-25T10:17:09.473

Modified: 2026-08-13T15:06:10.537

Link: CVE-2026-64288

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64288 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T19:30:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object