CVE-2024-35980 is a vulnerability in the Linux kernel specifically affecting the arm64 architecture's handling of the Translation Lookaside Buffer Invalidate (TLBI) RANGE operand. The issue arises in the Kernel-based Virtual Machine (KVM) implementation for arm64, which relies on the TLBI RANGE feature to flush TLBs during live migration of virtual machines (VMs). The vulnerability is caused by incorrect operand calculation passed to the TLBI RANGE instruction due to an incomplete implementation in the function __TLBI_RANGE_NUM(). This function fails to support the combination of SCALE#3 and NUM#31, which are parameters used to specify the range of pages to flush. As a result, the operand becomes invalid, leading to incomplete TLB flushes during live migration. This causes some dirty pages to be missed, ultimately resulting in a crash on the destination VM after migration. The problem manifests when large memory ranges are assigned to VMs (e.g., 8GB starting at 1GB address) and the TLB flush operation attempts to cover these ranges in one operation. The fix involves extending __TLBI_RANGE_NUM() to support the SCALE#3 and NUM#31 combination, allowing the TLB flush to cover 0x200000 page sizes correctly in a single operation. This correction prevents the operand underflow and invalid operand formation, ensuring complete TLB flushes and stable live migration. The vulnerability does not appear to have known exploits in the wild and is specific to arm64 KVM live migration scenarios on Linux kernels containing the faulty commit 117940aa6e5f. No CVSS score has been assigned yet.

For European organizations utilizing Linux-based virtualization environments on arm64 hardware, this vulnerability could lead to instability and crashes during live migration of VMs. Live migration is critical for load balancing, maintenance, and high availability in data centers and cloud environments. A crash on the destination VM can cause service disruption, potential data loss, and downtime. Although this vulnerability does not directly lead to privilege escalation or data leakage, the availability impact can be significant for organizations relying on continuous VM operation. The issue is particularly relevant for cloud service providers, telecom operators, and enterprises deploying arm64-based infrastructure in Europe. Given the growing adoption of arm64 servers for energy efficiency and performance, the risk surface is expanding. However, exploitation requires specific conditions: use of KVM on arm64, live migration of VMs with large memory assignments, and presence of the vulnerable kernel version. The absence of known exploits reduces immediate risk but does not eliminate the potential for future attacks or operational failures.

European organizations should promptly update their Linux kernels to versions that include the fix for CVE-2024-35980. Specifically, kernel versions that have patched the faulty commit 117940aa6e5f should be deployed. For environments where immediate patching is not feasible, temporary mitigation includes avoiding live migration of large-memory VMs on arm64 hosts or limiting VM memory sizes to reduce the likelihood of triggering the faulty TLBI RANGE operand. Additionally, organizations should audit their virtualization infrastructure to identify arm64 KVM hosts and verify kernel versions. Monitoring VM migration logs for crashes or anomalies can help detect exploitation or manifestation of the issue. Infrastructure teams should also test live migration workflows in staging environments after patching to ensure stability. Finally, maintaining a robust backup and disaster recovery plan is essential to mitigate potential data loss from unexpected VM crashes.