Linux kernel KVM/arm64: address rollover at the end of VA space makes TLB invalidation by VA silently fail

Impact

KVM's TLB-invalidation-by-VA code compared a range start plus size against the TLB entry's range. For the last page or block of the TTBR1 VA space that sum wraps to zero, so the comparison fails and the invalidation never happens - a guest can keep using a translation it was told was gone. The fix makes the end address inclusive and moves the comparison into a helper shared with IPA invalidation. This is an arm64 nested-virtualization path; on a GPU host that does not run nested guests it is not reachable.

Who can reach it

Local, from a guest on an arm64 KVM host with nested virtualization enabled, by arranging an invalidation at the top of the TTBR1 address range.

What to do

Update to a stable kernel with the linked commits and reboot each arm64 host after draining workloads. No runtime mitigation is described other than not running nested guests. Fixed versions are not stated in the record.

References

Related entries

• Linux kernel KVM nVMX: queued TLB flushes skipped when a nested VM-Enter fails, leaving stale VPID mappingsCVE-2026-89930 · Linux kernel KVM nVMX (TLB flush on failed nested VM-Enter)Critical
• PHP: uninitialized memory on OOM longjmp leads to remote code execution, in CISA KEVCVE-2026-109618 · PHP (out-of-memory longjmp request teardown)Critical
• Brotli: out-of-bounds write in the decoder allows remote unauthenticated code executionCVE-2026-111497 · Google Brotli decoder (c/dec/decode.c)Critical
• glibc: wordexp() reads out of bounds on a crafted pattern, crashing or leaking memoryCVE-2021-35942 · GNU C Library (glibc) wordexp() parameter parsingCritical
• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical
• OpenSSL: SSL_select_next_proto() over-reads and can send up to 255 bytes of process memory to the peerCVE-2024-5535 · OpenSSL SSL_select_next_proto() (ALPN/NPN protocol negotiation)Critical