7.8

CVE-2026-63875: linux Incomplete Cleanup

CVSS: 7.8v3.1HighAwaiting analysis
AliasesUBUNTU-CVE-2026-63875DEBIAN-CVE-2026-63875
Published 19-07-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-63875 is a high (CVSS 7.8) Incomplete Cleanup vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.7% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 29 · Related 26
OPENSUSE-SU-2026:21555-1RHSA-2026:72467RHSA-2026:72468RHSA-2026:72623SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush() only checked tlb->freed_tables to determine whether to use TLBF_NONE (vae1is, invalidates walk cache) or TLBF_NOWALKCACHE (vale1is, leaf-only). This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks. Fix by including unshared_tables in the check, so that when unsharing tables, TLBF_NONE is used and the walk cache is properly invalidated. Here is the detailed distinction between vae1is and vale1is: | Instruction Combination | Actual Invalidation Scope | | ------------------------ | --------------------------------------------------| | `VAE1IS` + TTL=`0` | All entries at all levels (full invalidation) | | `VAE1IS` + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 | | `VALE1IS` + TTL=`0` | Leaf entries at all levels (non-leaf not cleared) | | `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only |

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

0.00 pp

From 0.18% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu148 products
  • linux< 5.15.0-198.208 | < 6.8.0-146.146 | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1117.124 | < 6.8.0-1066.69 | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.12-1
Linux1 product
  • linux≥ 6495204f8219a57859669d618b25d06176d5a872, < dced308d7d6a0de1c09d2058f38f1aaaf5cbb914 | ≥ ce4cf24761467756462c0e1dbe4a5e9c9eb520fc, < 47490bbb05c8c0e09cc3cfd237d8934ffc340583 | ≥ daa6707b71a2da23a82979fa21f788aeb706f1a2, < 0199c9d57861f17b556b6cba1f765c7cce79745b | ≥ ff37dd18ce7739a26aab0cc2d31006a45e6bde63, < d766a49d9b55705c4737cd8bb5d3faa2d31330fd | ≥ da06bb0ca45b1ca6f1ab55023e34e61a520337f3, < 8ca7284da0e67b3e71d90ec17f08286774245ad9 | ≥ 9b671f6f432be07c0ddd66e437d6d0e0db684f83, < fe93e907b1af03cc229a80aa64a570a103d2b279 | ≥ 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1, < 48125cd9c55cbe297b59fd1f9bda48b0960bd181 | ≥ 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1, < c2ff4764e03e7a8d758352f4aceb8fe1be6ac971 | ≥ 5.10.253, < 5.10.259 | ≥ 5.15.203, < 5.15.210 | ≥ 6.1.167, < 6.1.176 | ≥ 6.6.127, < 6.6.143 | ≥ 6.12.74, < 6.12.93 | ≥ 6.18.13, < 6.18.35 | 6.19

3 vendors · 150 products

References

32 links
Show all 32 references