CVE-2026-63875 Linux CVE debrief

Who should care

System administrators and security teams managing Linux kernel systems, especially those using arm64 architecture, should be aware of this vulnerability. Although details are limited, the issue could potentially lead to incorrect page table walks if not properly patched.

Technical summary

In the Linux kernel, a vulnerability has been resolved that involved the arm64 tlb_flush() function. Specifically, when huge_pmd_unshare() was called to unshare a PMD table, tlb_unshare_pmd_ptdesc() set tlb->unshared_tables=true. However, the aarch64 tlb_flush() only checked tlb->freed_tables to determine whether to use TLBF_NONE (vae1is, invalidates walk cache) or TLBF_NOWALKCACHE (vale1is, leaf-only). This oversight caused stale PMD page table entries to remain in the walk cache after unshare, potentially leading to incorrect page table walks. The fix involves including unshared_tables in the check, ensuring that when tables are unshared, TLBF_NONE is used and the walk cache is properly invalidated.

Defensive priority

Medium to High. Although exploitation details are not provided, the vulnerability could lead to system instability or potential elevation of privilege if exploited.

Recommended defensive actions

• Apply the official patch provided by the Linux kernel maintainers.
• Ensure all Linux kernel systems, especially those using arm64 architecture, are updated with the latest security patches.
• Monitor system logs for any suspicious page table walk activities.
• Consider implementing additional monitoring and compensating controls until the patch can be applied.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The official CVE record and NVD detail page are the primary sources for this debrief. Additional information from kernel.org references may be necessary for a comprehensive understanding.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.