CVE-2026-64288 addresses a vulnerability in the Linux kernel's KVM arm64 subsystem where VNCR TLB invalidation functions could dereference a NULL pointer due to a race condition between MMU notifiers or TLBI instructions and the vCPU initialization state. Specifically, the function kvm_invalidate_vncr_va() did not check for allocation before dereferencing, unlike kvm_invalidate_vncr_ipa(). The patch introduces a new iterator that performs necessary checks to avoid NULL pointer dereferences during TLB invalidation.

The vulnerability could cause kernel crashes or instability due to NULL pointer dereferences during virtual CPU initialization and TLB invalidation. There is no information about exploitation in the wild or further impact such as privilege escalation or code execution.

A fix has been implemented in the Linux kernel to address this issue by adding proper checks before dereferencing pointers during TLB invalidation. Users should apply the official kernel updates containing this fix when available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.