CVE-2026-89911 (GCVE-0-2026-89911)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:40
VLAI
Title
KVM: arm64: Correctly cap TLBI Range to the architural limit
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means it is pretty easy for a guest to generate an overflow should the hypervisor be naive enough to add the range to the base... Make sure the range is capped to the limit dictated by the address bit that determines the VA range. For an IPA invalidation, this is further corrected down the line to ignore the upper range.
Severity
7.9 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 , < 566b1f08d983615f731cc693f2ad59db302c6b57 (git)
Affected: 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 , < 2de38f0448b45d27eba984fc0d9edb7a138972c2 (git)
Affected: 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 , < 69a598288195947a1662b53de702eb6976af96b7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "566b1f08d983615f731cc693f2ad59db302c6b57",
              "status": "affected",
              "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
              "versionType": "git"
            },
            {
              "lessThan": "2de38f0448b45d27eba984fc0d9edb7a138972c2",
              "status": "affected",
              "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
              "versionType": "git"
            },
            {
              "lessThan": "69a598288195947a1662b53de702eb6976af96b7",
              "status": "affected",
              "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Correctly cap TLBI Range to the architural limit\n\nTLB Invalidation by Range has a fairly powerful way of encoding pretty\nlarge ranges in a small number of bits. This range can be based on an\narbitrary VA, which means it is pretty easy for a guest to generate an\noverflow should the hypervisor be naive enough to add the range to the\nbase...\n\nMake sure the range is capped to the limit dictated by the address bit\nthat determines the VA range. For an IPA invalidation, this is further\ncorrected down the line to ignore the upper range."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A nested arm64 guest reaches decode_range_tlbi() by executing a range TLBI (RVAE/RIPAS2 and related encodings) that traps through kvm_handle_sys_reg into handle_tlbi_el2/handle_ripas2e1is; this is local KVM vCPU execution via /dev/kvm, not a network, adjacent, or physical path.\nAC:L - Once nested virt is available (kvm-arm.mode=nested and KVM_ARM_VCPU_HAS_EL2), the guest fully controls the TLBI operand and can deterministically encode a base+range that overflows the VA half-space; no race or attacker-uncontrollable timing is required.\nPR:L - The attacker must run code in a nested-capable KVM guest or create such a VM through /dev/kvm (typically kvm-group). That is low privilege relative to the host; the emulated TLBI path does not require init-namespace root.\nUI:N - After the nested VM is running, exploitation is triggered solely by the guest executing the range TLBI; no additional host-user or victim action is required.\nS:C - The bug is in KVM\u2019s nested-virtualization TLB/VNCR handling: an L1 TLBI is misapplied by L0, so host-maintained VNCR and related nested MMU state is not invalidated, crossing the guest/hypervisor security boundary.\nC:L - A wrapping range causes missed VNCR invalidation, so L0 may keep using a stale guest page for EL2 sysreg state and expose that bounded nested-hypervisor data to a page L1 believed unmapped (for example reused by L2). This is not an arbitrary host-memory read.\nI:L - The host may keep writing nested EL2 sysreg state through the stale VNCR mapping into a guest page that should have been invalidated, corrupting bounded nested-virt state rather than providing an arbitrary host write or control-flow hijack.\nA:H - Failed range invalidation leaves stale nested translations that can crash or hang the nested hypervisor or L2 workload, and the guest can repeat the TLBI at will, which is a complete availability loss for that nested VM."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:40:01.708Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/566b1f08d983615f731cc693f2ad59db302c6b57"
        },
        {
          "url": "https://git.kernel.org/stable/c/2de38f0448b45d27eba984fc0d9edb7a138972c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/69a598288195947a1662b53de702eb6976af96b7"
        }
      ],
      "title": "KVM: arm64: Correctly cap TLBI Range to the architural limit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89911",
    "datePublished": "2026-09-16T10:32:08.598Z",
    "dateReserved": "2026-09-11T19:38:34.774Z",
    "dateUpdated": "2026-09-16T14:40:01.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89911",
      "date": "2026-09-25",
      "epss": "0.00159",
      "percentile": "0.04257"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/include/asm/kvm_nested.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "566b1f08d983615f731cc693f2ad59db302c6b57",
                    "status": "affected",
                    "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2de38f0448b45d27eba984fc0d9edb7a138972c2",
                    "status": "affected",
                    "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "69a598288195947a1662b53de702eb6976af96b7",
                    "status": "affected",
                    "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/include/asm/kvm_nested.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Correctly cap TLBI Range to the architural limit\n\nTLB Invalidation by Range has a fairly powerful way of encoding pretty\nlarge ranges in a small number of bits. This range can be based on an\narbitrary VA, which means it is pretty easy for a guest to generate an\noverflow should the hypervisor be naive enough to add the range to the\nbase...\n\nMake sure the range is capped to the limit dictated by the address bit\nthat determines the VA range. For an IPA invalidation, this is further\ncorrected down the line to ignore the upper range."
          }
        ],
        "id": "CVE-2026-89911",
        "lastModified": "2026-09-16T15:18:17.300",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.9,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 5.3,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:17:00.127",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2de38f0448b45d27eba984fc0d9edb7a138972c2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/566b1f08d983615f731cc693f2ad59db302c6b57"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/69a598288195947a1662b53de702eb6976af96b7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T01:43:05Z",
      "cve": "CVE-2026-89911",
      "id": "CVE-2026-89911",
      "initial_release_date": "2026-09-17T16:35:13Z",
      "product_status:known_not_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89911",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89911.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.