GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89914 (GCVE-0-2026-89914)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:40
VLAI
Title
KVM: arm64: Sign-extend VA for range-based TLBI invalidation
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decode_range_tlbi() helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not overflow PA bits when this is used for S2 invalidation.
Severity
9.3 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 85bba00425ae0b4b30938ebfdde6d986e5423aff , < 72bce82c4171bf330919ff1b64dc0a36c254ec7d (git)
Affected: 85bba00425ae0b4b30938ebfdde6d986e5423aff , < 3feb83918e30f0472e058224b926ebfe8a064fac (git)
Affected: 85bba00425ae0b4b30938ebfdde6d986e5423aff , < 2393470085649f0b973ecceb26fe8fc71edde0c1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h",
            "arch/arm64/kvm/sys_regs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "72bce82c4171bf330919ff1b64dc0a36c254ec7d",
              "status": "affected",
              "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff",
              "versionType": "git"
            },
            {
              "lessThan": "3feb83918e30f0472e058224b926ebfe8a064fac",
              "status": "affected",
              "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff",
              "versionType": "git"
            },
            {
              "lessThan": "2393470085649f0b973ecceb26fe8fc71edde0c1",
              "status": "affected",
              "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h",
            "arch/arm64/kvm/sys_regs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Sign-extend VA for range-based TLBI invalidation\n\nWhen the decode_range_tlbi() helper was moved to be used for S1 TLBIs,\nthe required sign extension was omitted. Add it.\n\nAs a result, special care must be taken to not overflow PA bits when\nthis is used for S2 invalidation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A nested arm64 L1 hypervisor reaches decode_range_tlbi() by executing a range TLBI (RVAE2/RVAE1/RIPAS2 and variants) that traps via ESR_ELx_EC_SYS64 into kvm_handle_sys_reg during KVM_RUN. This is local guest execution, not a network, adjacent-radio, or physical-device path.\nAC:L - An L1 guest fully controls the TLBI Xt encoding (BASEADDR/TG/NUM/SCALE) and can deterministically hit the missing sign-extension for canonical high VAs. Nested virt and FEAT_TLBIRANGE on arm64 cloud hosts are attacker-selectable deployments, not an uncontrollable race or rare kernel config.\nPR:N - Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR_EL2 setup, S1 page-table updates, and EL2 range TLBIs are fully attacker-driven from the guest.\nS:C - Missed high-VA VNCR invalidation leaves the host per-CPU PAGE_KERNEL fixmap covering a stale guest HPA while KVM emulates nested EL2 register state, crossing the guest-to-hypervisor security boundary (Changed per CNA KVM guidance).\nC:H - Without sign_extend64(base, 48), range TLBIs for canonical high GVAs never match vt-\u003egva, so the VNCR pseudo-TLB retains the old HPA; host KVM then reads that physical page through the kernel fixmap during sysreg emulation, disclosing whatever now backs that HPA.\nI:H - kvm_map_l1_vncr() installs a writable PAGE_KERNEL fixmap of the stale HPA when S1 write permissions allow, so nested EL2 register writes land in pages the guest already rebound, giving a write primitive against host-managed physical memory.\nA:H - Accessing an unmapped or reused HPA through the VNCR fixmap can oops or panic the host kernel, and corrupting emulated EL2 state or leaving stale nested translations can hang or crash the hypervisor and co-resident VMs; the attacker can retrigger the range TLBI."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:40:06.342Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/72bce82c4171bf330919ff1b64dc0a36c254ec7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3feb83918e30f0472e058224b926ebfe8a064fac"
        },
        {
          "url": "https://git.kernel.org/stable/c/2393470085649f0b973ecceb26fe8fc71edde0c1"
        }
      ],
      "title": "KVM: arm64: Sign-extend VA for range-based TLBI invalidation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89914",
    "datePublished": "2026-09-16T10:32:10.631Z",
    "dateReserved": "2026-09-11T19:38:34.774Z",
    "dateUpdated": "2026-09-16T14:40:06.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89914",
      "date": "2026-09-20",
      "epss": "0.00178",
      "percentile": "0.07632"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/include/asm/kvm_nested.h",
                  "arch/arm64/kvm/sys_regs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "72bce82c4171bf330919ff1b64dc0a36c254ec7d",
                    "status": "affected",
                    "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3feb83918e30f0472e058224b926ebfe8a064fac",
                    "status": "affected",
                    "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2393470085649f0b973ecceb26fe8fc71edde0c1",
                    "status": "affected",
                    "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/arm64/include/asm/kvm_nested.h",
                  "arch/arm64/kvm/sys_regs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Sign-extend VA for range-based TLBI invalidation\n\nWhen the decode_range_tlbi() helper was moved to be used for S1 TLBIs,\nthe required sign extension was omitted. Add it.\n\nAs a result, special care must be taken to not overflow PA bits when\nthis is used for S2 invalidation."
          }
        ],
        "id": "CVE-2026-89914",
        "lastModified": "2026-09-16T15:18:17.647",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:17:00.443",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2393470085649f0b973ecceb26fe8fc71edde0c1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3feb83918e30f0472e058224b926ebfe8a064fac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/72bce82c4171bf330919ff1b64dc0a36c254ec7d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-19T01:43:01Z",
      "cve": "CVE-2026-89914",
      "id": "CVE-2026-89914",
      "initial_release_date": "2026-09-17T16:35:05Z",
      "product_status:known_not_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89914",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89914.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.