{"id":"CVE-2024-26670","title":"arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD\n\nCurrently the ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround isn't\nquite right, as it is supposed to be…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"adp","vendor":"Linux","product":"Linux","affected":["Linux >= 6e3ae2927b432a3b7c8374f14dbc1bd9ebe4372c < d9a9a4d8ebc2fa534c0eb3eef3dae45f5e61b3e3","Linux >= 471470bc7052d28ce125901877dd10e4c048e513 < 58eb5c07f41704464b9acc09ab0707b6769db6c0","Linux >= 471470bc7052d28ce125901877dd10e4c048e513 < baa0aaac16432019651e0d60c41cd34a0c3c3477","Linux >= 471470bc7052d28ce125901877dd10e4c048e513 < 832dd634bd1b4e3bbe9f10b9c9ba5db6f6f2b97f","Linux 32b0a4ffcaea44a00a61e40c0d1bcc50362aee25","Linux >= 6.1.57 < 6.1.191","Linux >= 6.5.7 < 6.6","Linux 6.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-10-01T18:00:39.275223Z"},"published":"2024-04-02","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:17:46.615Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-26670","references":[{"url":"https://git.kernel.org/stable/c/d9a9a4d8ebc2fa534c0eb3eef3dae45f5e61b3e3"},{"url":"https://git.kernel.org/stable/c/58eb5c07f41704464b9acc09ab0707b6769db6c0"},{"url":"https://git.kernel.org/stable/c/baa0aaac16432019651e0d60c41cd34a0c3c3477"},{"url":"https://git.kernel.org/stable/c/832dd634bd1b4e3bbe9f10b9c9ba5db6f6f2b97f"}],"tags":["cve.org"],"epss":0.00225,"epssPercentile":0.13246,"ingestedAt":"2026-11-03T11:43:15.793Z","slug":"CVE-2024-26670","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD\n\nCurrently the ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround isn't\nquite right, as it is supposed to be applied after the last explicit\nmemory access, but is immediately followed by an LDR.\n\nThe ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround is used to\nhandle Cortex-A520 erratum 2966298 and Cortex-A510 erratum 3117295,\nwhich are described in:\n\n* https://developer.arm.com/documentation/SDEN2444153/0600/?lang=en\n* https://developer.arm.com/documentation/SDEN1873361/1600/?lang=en\n\nIn both cases the workaround is described as:\n\n| If pagetable isolation is disabled, the context switch logic in the\n| kernel can be updated to execute the following sequence on affected\n| cores before exiting to EL0, and after all explicit memory accesses:\n|\n| 1. A non-shareable TLBI to any context and/or address, including\n|    unused contexts or addresses, such as a `TLBI VALE1 Xzr`.\n|\n| 2. A DSB NSH to guarantee completion of the TLBI.\n\nThe important part being that the TLBI+DSB must be placed \"after all\nexplicit memory accesses\".\n\nUnfortunately, as-implemented, the TLBI+DSB is immediately followed by\nan LDR, as we have:\n\n| alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD\n| \ttlbi\tvale1, xzr\n| \tdsb\tnsh\n| alternative_else_nop_endif\n| alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0\n| \tldr\tlr, [sp, #S_LR]\n| \tadd\tsp, sp, #PT_REGS_SIZE\t\t// restore sp\n| \teret\n| alternative_else_nop_endif\n|\n| [ ... KPTI exception return path ... ]\n\nThis patch fixes this by reworking the logic to place the TLBI+DSB\nimmediately before the ERET, after all explicit memory accesses.\n\nThe ERET is currently in a separate alternative block, and alternatives\ncannot be nested. To account for this, the alternative block for\nARM64_UNMAP_KERNEL_AT_EL0 is replaced with a single alternative branch\nto skip the KPTI logic, with the new shape of the logic being:\n\n| alternative_insn \"b .L_skip_tramp_exit_\\@\", nop, ARM64_UNMAP_KERNEL_AT_EL0\n| \t[ ... KPTI exception return path ... ]\n| .L_skip_tramp_exit_\\@:\n|\n| \tldr\tlr, [sp, #S_LR]\n| \tadd\tsp, sp, #PT_REGS_SIZE\t\t// restore sp\n|\n| alternative_if ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD\n| \ttlbi\tvale1, xzr\n| \tdsb\tnsh\n| alternative_else_nop_endif\n| \teret\n\nThe new structure means that the workaround is only applied when KPTI is\nnot in use; this is fine as noted in the documented implications of the\nerratum:\n\n| Pagetable isolation between EL0 and higher level ELs prevents the\n| issue from occurring.\n\n... and as per the workaround description quoted above, the workaround\nis only necessary \"If pagetable isolation is disabled\".\n\n## Affected\n\n- `Linux >= 6e3ae2927b432a3b7c8374f14dbc1bd9ebe4372c < d9a9a4d8ebc2fa534c0eb3eef3dae45f5e61b3e3`\n- `Linux >= 471470bc7052d28ce125901877dd10e4c048e513 < 58eb5c07f41704464b9acc09ab0707b6769db6c0`\n- `Linux >= 471470bc7052d28ce125901877dd10e4c048e513 < baa0aaac16432019651e0d60c41cd34a0c3c3477`\n- `Linux >= 471470bc7052d28ce125901877dd10e4c048e513 < 832dd634bd1b4e3bbe9f10b9c9ba5db6f6f2b97f`\n- `Linux 32b0a4ffcaea44a00a61e40c0d1bcc50362aee25`\n- `Linux >= 6.1.57 < 6.1.191`\n- `Linux >= 6.5.7 < 6.6`\n- `Linux 6.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}