CVE-2026-89914 (GCVE-0-2026-89914)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-19 08:54
Severity ?
9.3 (Critical) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decode_range_tlbi() helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not overflow PA bits when this is used for S2 invalidation.
References
Impacted products
Vendor Product Version
Linux Linux Version: 85bba00425ae0b4b30938ebfdde6d986e5423aff
Version: 85bba00425ae0b4b30938ebfdde6d986e5423aff
Version: 85bba00425ae0b4b30938ebfdde6d986e5423aff
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h",
            "arch/arm64/kvm/sys_regs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "72bce82c4171bf330919ff1b64dc0a36c254ec7d",
              "status": "affected",
              "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff",
              "versionType": "git"
            },
            {
              "lessThan": "3feb83918e30f0472e058224b926ebfe8a064fac",
              "status": "affected",
              "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff",
              "versionType": "git"
            },
            {
              "lessThan": "2393470085649f0b973ecceb26fe8fc71edde0c1",
              "status": "affected",
              "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h",
            "arch/arm64/kvm/sys_regs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Sign-extend VA for range-based TLBI invalidation\n\nWhen the decode_range_tlbi() helper was moved to be used for S1 TLBIs,\nthe required sign extension was omitted. Add it.\n\nAs a result, special care must be taken to not overflow PA bits when\nthis is used for S2 invalidation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A nested arm64 L1 hypervisor reaches decode_range_tlbi() by executing a range TLBI (RVAE2/RVAE1/RIPAS2 and variants) that traps via ESR_ELx_EC_SYS64 into kvm_handle_sys_reg during KVM_RUN. This is local guest execution, not a network, adjacent-radio, or physical-device path.\nAC:L - An L1 guest fully controls the TLBI Xt encoding (BASEADDR/TG/NUM/SCALE) and can deterministically hit the missing sign-extension for canonical high VAs. Nested virt and FEAT_TLBIRANGE on arm64 cloud hosts are attacker-selectable deployments, not an uncontrollable race or rare kernel config.\nPR:N - Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR_EL2 setup, S1 page-table updates, and EL2 range TLBIs are fully attacker-driven from the guest.\nS:C - Missed high-VA VNCR invalidation leaves the host per-CPU PAGE_KERNEL fixmap covering a stale guest HPA while KVM emulates nested EL2 register state, crossing the guest-to-hypervisor security boundary (Changed per CNA KVM guidance).\nC:H - Without sign_extend64(base, 48), range TLBIs for canonical high GVAs never match vt-\u003egva, so the VNCR pseudo-TLB retains the old HPA; host KVM then reads that physical page through the kernel fixmap during sysreg emulation, disclosing whatever now backs that HPA.\nI:H - kvm_map_l1_vncr() installs a writable PAGE_KERNEL fixmap of the stale HPA when S1 write permissions allow, so nested EL2 register writes land in pages the guest already rebound, giving a write primitive against host-managed physical memory.\nA:H - Accessing an unmapped or reused HPA through the VNCR fixmap can oops or panic the host kernel, and corrupting emulated EL2 state or leaving stale nested translations can hang or crash the hypervisor and co-resident VMs; the attacker can retrigger the range TLBI."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:54:47.824Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/72bce82c4171bf330919ff1b64dc0a36c254ec7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3feb83918e30f0472e058224b926ebfe8a064fac"
        },
        {
          "url": "https://git.kernel.org/stable/c/2393470085649f0b973ecceb26fe8fc71edde0c1"
        }
      ],
      "title": "KVM: arm64: Sign-extend VA for range-based TLBI invalidation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89914",
    "datePublished": "2026-09-16T10:32:10.631Z",
    "dateReserved": "2026-09-11T19:38:34.774Z",
    "dateUpdated": "2026-10-19T08:54:47.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.