In the Linux kernel, the following vulnerability has been resolved:

arm64: tlb: Flush walk cache when unsharing PMD tables

When huge_pmd_unshare() is called to unshare a PMD table, the
tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true
but the aarch64 tlb_flush() only checked tlb->freed_tables to
determine whether to use TLBF_NONE (vae1is, invalidates walk
cache) or TLBF_NOWALKCACHE (vale1is, leaf-only).

This caused the stale PMD page table entry to remain in the walk cache
after unshare, potentially leading to incorrect page table walks.

Fix by including unshared_tables in the check, so that when
unsharing tables, TLBF_NONE is used and the walk cache is properly
invalidated.

Here is the detailed distinction between vae1is and vale1is:

| Instruction Combination  | Actual Invalidation Scope                         |
| ------------------------ | --------------------------------------------------|
| `VAE1IS`  + TTL=`0`      | All entries at all levels (full invalidation)     |
| `VAE1IS`  + TTL=`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2           |
| `VALE1IS` + TTL=`0`      | Leaf entries at all levels (non-leaf not cleared) |
| `VALE1IS` + TTL=`2` (L2) | Leaf entry at Level 2 only                        |

https://git.kernel.org/stable/c/0199c9d57861f17b556b6cba1f765c7cce79745b

https://git.kernel.org/stable/c/47490bbb05c8c0e09cc3cfd237d8934ffc340583

https://git.kernel.org/stable/c/48125cd9c55cbe297b59fd1f9bda48b0960bd181

https://git.kernel.org/stable/c/8ca7284da0e67b3e71d90ec17f08286774245ad9

https://git.kernel.org/stable/c/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971

https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd

https://git.kernel.org/stable/c/dced308d7d6a0de1c09d2058f38f1aaaf5cbb914

https://git.kernel.org/stable/c/fe93e907b1af03cc229a80aa64a570a103d2b279

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/include/asm/tlb.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6495204f8219a57859669d618b25d06176d5a872","lessThan":"dced308d7d6a0de1c09d2058f38f1aaaf5cbb914","versionType":"git","status":"affected"},{"version":"ce4cf24761467756462c0e1dbe4a5e9c9eb520fc","lessThan":"47490bbb05c8c0e09cc3cfd237d8934ffc340583","versionType":"git","status":"affected"},{"version":"daa6707b71a2da23a82979fa21f788aeb706f1a2","lessThan":"0199c9d57861f17b556b6cba1f765c7cce79745b","versionType":"git","status":"affected"},{"version":"ff37dd18ce7739a26aab0cc2d31006a45e6bde63","lessThan":"d766a49d9b55705c4737cd8bb5d3faa2d31330fd","versionType":"git","status":"affected"},{"version":"da06bb0ca45b1ca6f1ab55023e34e61a520337f3","lessThan":"8ca7284da0e67b3e71d90ec17f08286774245ad9","versionType":"git","status":"affected"},{"version":"9b671f6f432be07c0ddd66e437d6d0e0db684f83","lessThan":"fe93e907b1af03cc229a80aa64a570a103d2b279","versionType":"git","status":"affected"},{"version":"8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1","lessThan":"48125cd9c55cbe297b59fd1f9bda48b0960bd181","versionType":"git","status":"affected"},{"version":"8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1","lessThan":"c2ff4764e03e7a8d758352f4aceb8fe1be6ac971","versionType":"git","status":"affected"},{"version":"5.10.253","lessThan":"5.10.259","versionType":"semver","status":"affected"},{"version":"5.15.203","lessThan":"5.15.210","versionType":"semver","status":"affected"},{"version":"6.1.167","lessThan":"6.1.176","versionType":"semver","status":"affected"},{"version":"6.6.127","lessThan":"6.6.143","versionType":"semver","status":"affected"},{"version":"6.12.74","lessThan":"6.12.93","versionType":"semver","status":"affected"},{"version":"6.18.13","lessThan":"6.18.35","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/include/asm/tlb.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]