CVE-2026-79979

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidatetlbpage in arch/arm64/core/mmu.c, which issued TLBI VAE1IS with an operand of virt 12. That operand encodes the ASID in bits 63:48, so the invalidation only ever matched ASID 0 the kernel page tables and global...

CVE-2026-79979 Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidatetlbpage in arch/arm64/core/mmu.c, which issued TLBI VAE1IS with an operand of virt 12. That operand encodes the ASID in bits 63:48, so the invalidation only ever matched ASID 0 the kernel page tables and global...