Xen: Stale TLB Entry Ahead of Page Scrubbing (XSA-511)

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

CVE-2026-79603

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

ALPINE-CVE-2026-79603

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

CVE-2026-79603 Unconditionally do TLB flushing ahead of page scrubbing

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

CVE-2026-79603

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

UBUNTU-CVE-2026-79603

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

CVE-2026-79603: Improper Control of a Resource Through its Lifetime

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

PT-2026-87052

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

Stale Translation Lookaside Buffer (TLB) Entry Vulnerability

Summary An internally reported microcode bug in some EPYC™ AMD CPUs could allow a local admin-privileged attacker to run SEV-SNP Secure Encrypted Virtualization - Secure Nested Paging guests using stale TLB entries. This bug could allow SNP active vCPUs to reuse TLB entries from other virtual...

SUSE-SU-2022:3406-1 Security update for the Linux Kernel (Live Patch 2 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-1504002418 fixes one issue. The following security issue was fixed: - CVE-2022-39188: Fixed a race condition between unmapmappingrange and munmap on VMPFNMAP mappings leads to stale TLB entry bsc1203116...

SUSE-SU-2022:3412-1 Security update for the Linux Kernel (Live Patch 1 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-1504002411 fixes several issues. The following security issues were fixed: - CVE-2022-29581: Fixed an improper Update of Reference Count vulnerability in net/sched that causes privilege escalation to root bsc1199695. - CVE-2022-39188: Fixed a race conditio...

SUSE-SU-2022:3409-1 Security update for the Linux Kernel (Live Patch 27 for SLE 15)

This update for the Linux Kernel 4.12.14-15083 fixes several issues. The following security issues were fixed: - CVE-2022-39188: Fixed a race condition between unmapmappingrange and munmap on VMPFNMAP mappings leads to stale TLB entry bsc1203116. - CVE-2022-1652: Fixed a use-after-free in...

SUSE-SU-2022:3379-1 Security update for the Linux Kernel (Live Patch 35 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122133 fixes one issue. The following security issue was fixed: - CVE-2022-39188: Fixed a race condition between unmapmappingrange and munmap on VMPFNMAP mappings leads to stale TLB entry bsc1203116...

SUSE-SU-2022:3372-1 Security update for the Linux Kernel (Live Patch 28 for SLE 12 SP4)

This update for the Linux Kernel 4.12.14-95102 fixes one issue. The following security issue was fixed: - CVE-2022-39188: Fixed a race condition between unmapmappingrange and munmap on VMPFNMAP mappings leads to stale TLB entry bsc1203116...

SUSE-SU-2022:3362-1 Security update for the Linux Kernel (Live Patch 32 for SLE 15)

This update for the Linux Kernel 4.12.14-15000015098 fixes one issue. The following security issue was fixed: - CVE-2022-39188: Fixed a race condition between unmapmappingrange and munmap on VMPFNMAP mappings leads to stale TLB entry bsc1203116...

CVE-2020-27674: Out-of-bounds Write

An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique...

SUSE-SU-2018:4069-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device with zero interfaces that is mishandled ...

DEBIAN-CVE-2018-18281

Since Linux kernel version 3.2, the mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the pagetables of a task that is in the middle of mremap, a stale TLB entry can remain for a short time that permits access to a physical pag...

CVE-2018-18281: Incomplete Cleanup

Since Linux kernel version 3.2, the mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the pagetables of a task that is in the middle of mremap, a stale TLB entry can remain for a short time that permits access to a physical pag...

Linux mremap() TLB Flush Too Late

Linux: mremap TLB flush too late with concurrent ftruncate CVE-2018-18281 Tested on the master branch 4.19.0-rc7+. sysmremap takes current-mm-mmapsem for writing, then calls mremapto-movevma-movepagetables. movepagetables first calls moveptes which takes PTE locks, moves PTEs, and drops PTE locks...