In the Linux kernel, the following vulnerability has been resolved:
arm64: tlb: Fix TLBI RANGE operand
KVM/arm64 relies on TLBI RANGE feature to flush TLBs when the dirty pages are collected by VMM and the page table entries become write protected during live migration. Unfortunately, the operand passed to the TLBI RANGE instruction isn't correctly sorted out due to the commit 117940aa6e5f ("KVM: arm64: Define kvm_tlb_flush_vmid_range()"). It leads to crash on the destination VM after live migration because TLBs aren't flushed completely and some of the dirty pages are missed.
For example, I have a VM where 8GB memory is assigned, starting from 0x40000000 (1GB). Note that the host has 4KB as the base page size. In the middile of migration, kvm_tlb_flush_vmid_range() is executed to flush TLBs. It passes MAX_TLBI_RANGE_PAGES as the argument to __kvm_tlb_flush_vmid_range() and __flush_s2_tlb_range_op(). SCALE#3 and NUM#31, corresponding to MAX_TLBI_RANGE_PAGES, isn't supported by __TLBI_RANGE_NUM(). In this specific case, -1 has been returned from __TLBI_RANGE_NUM() for SCALE#3/2/1/0 and rejected by the loop in the __flush_tlb_range_op() until the variable @scale underflows and becomes -9, 0xffff708000040000 is set as the operand. The operand is wrong since it's sorted out by __TLBI_VADDR_RANGE() according to invalid @scale and @num.
Fix it by extending __TLBI_RANGE_NUM() to support the combination of SCALE#3 and NUM#31. With the changes, [-1 31] instead of [-1 30] can be returned from the macro, meaning the TLBs for 0x200000 pages in the above example can be flushed in one shoot with SCALE#3 and NUM#31. The macro TLBI_RANGE_MASK is dropped since no one uses it any more. The comments are also adjusted accordingly.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2024 |
| Suse | — | Upgrade kernel-default-extraUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-vdsoUpgrade dtb-amlogicUpgrade kernel-obs-buildUpgrade ocfs2-kmp-rtUpgrade dtb-armUpgrade dlm-kmp-azureUpgrade dtb-apmUpgrade kernel-rtUpgrade kernel-source-azureUpgrade kernel-syms-rtUpgrade dlm-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade dtb-lgUpgrade dtb-broadcomUpgrade gfs2-kmp-64kbUpgrade dtb-marvellUpgrade kernel-default-base-rebuildUpgrade kernel-azure-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kbUpgrade kernel-sourceUpgrade dtb-freescaleUpgrade kernel-rt-vdsoUpgrade kernel-default-develUpgrade kselftests-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-rt-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt-livepatch-develUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-64kbUpgrade dtb-amazonUpgrade kselftests-kmp-defaultUpgrade kernel-syms-azureUpgrade dtb-qcomUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-rt-optionalUpgrade kernel-rt_debugUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-azureUpgrade dtb-exynosUpgrade kernel-macrosUpgrade kernel-source-rtUpgrade kernel-devel-azureUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-docsUpgrade dtb-sprdUpgrade kernel-debugUpgrade kernel-default-vdsoUpgrade kernel-source-vanillaUpgrade dtb-nvidiaUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-symsUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade dlm-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade dtb-appleUpgrade kernel-develUpgrade kernel-64kb-extraUpgrade kernel-rt-develUpgrade kernel-default-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-xilinxUpgrade kselftests-kmp-azureUpgrade kernel-64kb-optionalUpgrade dtb-mediatekUpgrade kernel-default-baseUpgrade dtb-amdUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade dtb-socionextUpgrade kernel-rt_debug-develUpgrade kernel-default-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-livepatchUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-hisiliconUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-azure-optionalUpgrade dtb-renesasUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rt | Dec 5, 2025 | Nov 13, 2024 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-intelUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-gkeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-38-genericUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-oracleUpgrade linux-image-gcpUpgrade linux-image-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-24.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-ibmUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-awsUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-ibm-lts-24.04 | Jul 12, 2024 | May 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub