CVE-2026-63875

In the Linux kernel, the following vulnerability has been resolved:

arm64: tlb: Flush walk cache when unsharing PMD tables

When hugepmdunshare() is called to unshare a PMD table, the tlbunsharepmdptdesc() function sets tlb->unsharedtables=true but the aarch64 tlbflush() only checked tlb->freedtables to determine whether to use TLBFNONE (vae1is, invalidates walk cache) or TLBFNOWALKCACHE (vale1is, leaf-only).

This caused the stale PMD page table entry to remain in the walk cache after unshare, potentially leading to incorrect page table walks.

Fix by including unsharedtables in the check, so that when unsharing tables, TLBFNONE is used and the walk cache is properly invalidated.

Here is the detailed distinction between vae1is and vale1is:

| Instruction Combination | Actual Invalidation Scope | | ------------------------ | --------------------------------------------------| | VAE1IS + TTL=0 | All entries at all levels (full invalidation) | | VAE1IS + TTL=2 (L2) | Non-leaf at Level 0/1 + leaf at Level 2 | | VALE1IS + TTL=0 | Leaf entries at all levels (non-leaf not cleared) | | VALE1IS + TTL=2 (L2) | Leaf entry at Level 2 only |