Linux kernel KVM/arm64: address rollover at the end of VA space makes TLB invalidation by VA silently fail

Impact

KVM's TLB-invalidation-by-VA code compared a range start plus size against the TLB entry's range. For the last page or block of the TTBR1 VA space that sum wraps to zero, so the comparison fails and the invalidation never happens - a guest can keep using a translation it was told was gone. The fix makes the end address inclusive and moves the comparison into a helper shared with IPA invalidation. This is an arm64 nested-virtualization path; on a GPU host that does not run nested guests it is not reachable.

Who can reach it

Local, from a guest on an arm64 KVM host with nested virtualization enabled, by arranging an invalidation at the top of the TTBR1 address range.

What to do

Update to a stable kernel with the linked commits and reboot each arm64 host after draining workloads. No runtime mitigation is described other than not running nested guests. Fixed versions are not stated in the record.

References

Related entries

• Linux kernel KVM nVMX: queued TLB flushes skipped when a nested VM-Enter fails, leaving stale VPID mappingsCVE-2026-89930 · Linux kernel KVM nVMX (TLB flush on failed nested VM-Enter)Critical
• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical
• Go x/crypto ssh/agent: destination restrictions silently dropped when adding keys to a remote agentCVE-2026-39832 · golang.org/x/crypto/ssh/agent (constraint extension serialization)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.c: The discovery controller validatedCVE-2026-64320 · Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.cCritical
• perf tools: out-of-bounds heap read parsing a crafted perf.data CPU indexCVE-2026-80670 · Linux kernel perf tools (machine__resolve() CPU index from perf.data samples)Critical