CVE-2026-64288: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB

VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions,
and either can race against a vcpu not being onlined yet (no pseudo-TLB
allocated). Similarly, the TLB might be invalid, and the invalidation
should be skipped in this case.

Both kvm_invalidate_vncr_ipa() and kvm_invalidate_vncr_va() are
expected to perform the same checks, except that the latter doesn't
check for the allocation and blindly dereferences the pointer.

Solve this by introducing a new iterator built on top of the usual
kvm_for_each_vcpu() that checks for both of the above conditions,
and convert the two users to it.

The Linux kernel CVE team has assigned CVE-2026-64288 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.16 with commit 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 and fixed in 6.18.39 with commit 7c73a269a880b1399baacfb9d521415e6ef7ecc2
	Issue introduced in 6.16 with commit 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 and fixed in 7.1.4 with commit 5fd30133af864a1de0a0bd87d3fe3cf23205fbc7
	Issue introduced in 6.16 with commit 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 and fixed in 7.2-rc1 with commit 4be6cbeb93d26994bd1827ddbce391e3c4395c8f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64288
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/arm64/kvm/nested.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7c73a269a880b1399baacfb9d521415e6ef7ecc2
	https://git.kernel.org/stable/c/5fd30133af864a1de0a0bd87d3fe3cf23205fbc7
	https://git.kernel.org/stable/c/4be6cbeb93d26994bd1827ddbce391e3c4395c8f