Linux kernel KVM/arm64: VNCR invalidation races nested page fault and installs a stale TLB entry

Impact

A VNCR TLB invalidation on one vCPU can race a second vCPU that is walking the stage-1 page tables for the same page. The faulting vCPU can insert a TLB entry for a translation that the other vCPU has just invalidated, so a nested guest keeps a mapping the guest hypervisor believes it has torn down - a stale-translation window between nested guests on the same host. The fix makes invalidate_vncr_va() bump mmu_invalidate_seq so the fault is replayed. Applies only to arm64 hosts running nested virtualization; a host with no nested guests never enters this path.

Who can reach it

Local, from a nested guest (or a guest hypervisor) on an arm64 KVM host with nested virtualization enabled. Requires the ability to run a VM on the host; no host authentication beyond that.

What to do

Take a stable kernel containing the linked commits and reboot each arm64 host, draining or migrating guests first. No mitigation short of disabling nested virtualization is described. The record gives commits, not fixed version numbers.

References

Related entries

• Linux kernel KVM/arm64: address rollover at the end of VA space makes TLB invalidation by VA silently failCVE-2026-89918 · Linux kernel KVM/arm64 (TLBI range comparison, end of TTBR1 VA space)Critical
• Linux kernel KVM nVMX: queued TLB flushes skipped when a nested VM-Enter fails, leaving stale VPID mappingsCVE-2026-89930 · Linux kernel KVM nVMX (TLB flush on failed nested VM-Enter)Critical
• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical
• Go x/crypto ssh/agent: destination restrictions silently dropped when adding keys to a remote agentCVE-2026-39832 · golang.org/x/crypto/ssh/agent (constraint extension serialization)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.c: The discovery controller validatedCVE-2026-64320 · Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.cCritical