CVE-2026-63875
In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush() only checked tlb->freed_tables to determine whether to use TLBF_NONE (vae1is, invalidates walk cache) or TLBF_NOWALKCACHE (vale1is, leaf-only). This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks. Fix by including unshared_tables in the check, so that when unsharing tables, TLBF_NONE is used and the walk cache is properly invalidated. Here is the detailed distinction between vae1is and vale1is: | Instruction Combination | Actual Invalidation Scope | | ------------------------ | --------------------------------------------------| | `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) | | `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 | | `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) | | `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |
Affected versions
Linux kernel versions
5.10.253,
5.15.203,
6.1.167,
6.6.127,
6.12.74,
6.18.13,
6.19
and later are affected. Fixed in
5.10.259,
5.15.210,
6.1.176,
6.6.143,
6.12.93,
6.18.35,
7.0.12,
7.1
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-63875?
CVE-2026-63875 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.10.253 onward and has been patched in 5.10.259, 5.15.210, 6.1.176 and others. CVE-2026-63875 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-63875?
Yes — CVE-2026-63875 has been patched. Fixed versions include 5.10.259, 5.15.210, 6.1.176 and others. If you are running Linux kernel 5.10.253 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-63875 actively exploited?
No — CVE-2026-63875 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.