{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89918", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.775Z", "datePublished": "2026-09-16T10:32:13.304Z", "dateUpdated": "2026-09-16T14:40:10.975Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T14:40:10.975Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Correctly handle end of VA space TLBI invalidation\n\nOur TLB invalidation by VA code is based on comparing two ranges,\none defined by the TLB, and one defined by the TLBI instruction.\n\nEach range is defined by a start and a size. However, the way the\ncomparison is done doesn't account for address rollover, as it\ncompares an address with (base + size). This works nicely until\nthis expression represent the last page/block in the TTBR1 VA space,\nas the result is a big fat 0. And a failed TLB invalidation.\n\nRewrite the comparison in a way that is immune to the address\nrollover (making the end address inclusive instead of exclusive),\nand move this into a common helper that is used by both VA and IPA\ninvalidations, as suggested by Hyunwoo Kim (although the IPA version\ndidn't suffer from this particular problem, obviously)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached when an arm64 nested-KVM L1 hypervisor executes EL2/EL1 TLBI-by-VA instructions that trap into KVM_RUN and run handle_tlbi_el2()/handle_tlbi_el1() \u2192 kvm_handle_s1e2_tlbi() \u2192 invalidate_vncr_va(); no network, adjacent-radio, or physical-device path reaches this VNCR pseudo-TLB comparison.\nAC:L - An attacker controlling an L1 nested hypervisor can place VNCR_EL2 on the last TTBR1 page or issue a VA-scoped TLBI for that range so base+size wraps to 0, causing a deterministic missed invalidation; nested virt on arm64 cloud hosts is an attacker-selectable deployment, not an uncontrollable condition.\nPR:N - Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR placement, stage-1 remaps, and TLBI-by-VA issuance are fully attacker-driven from within the guest.\nS:C - Failed VNCR pseudo-TLB invalidation leaves the host kernel's per-CPU fixmap aliasing a stale guest physical page for nested EL2 register state, so the hypervisor reads and writes the wrong memory after the guest remaps that VA, crossing the guest-to-hypervisor security boundary.\nC:H - A missed invalidation keeps a host PAGE_KERNEL fixmap to the old HPA after the L1 remaps VNCR_EL2, so KVM continues to read nested EL2 register state from a guest page that should no longer back VNCR, disclosing hypervisor-viewed contents across the stale translation.\nI:H - The same stale writable fixmap lets the host write nested EL2 register values into a guest page the L1 has already remapped or reused, and lets the guest inject attacker-controlled EL2 sysreg contents through the old page while KVM trusts it as VNCR, corrupting hypervisor-emulated nested state.\nA:H - Stale VNCR translations leave host KVM and FEAT_NV2 hardware using inconsistent nested EL2 state and the wrong guest page, which can crash or livelock the host nested-virt paths and deny service to co-resident VMs on the hypervisor."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/nested.c"], "versions": [{"version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "lessThan": "ce447651a52ec077694172af10c4fffb11f56c43", "status": "affected", "versionType": "git"}, {"version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "lessThan": "c624731ca6fe59ad8909ce4108301aa7560a91d6", "status": "affected", "versionType": "git"}, {"version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "lessThan": "34af2c3e31f91a739dc175459fdbd99ed952b457", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/nested.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ce447651a52ec077694172af10c4fffb11f56c43"}, {"url": "https://git.kernel.org/stable/c/c624731ca6fe59ad8909ce4108301aa7560a91d6"}, {"url": "https://git.kernel.org/stable/c/34af2c3e31f91a739dc175459fdbd99ed952b457"}], "title": "KVM: arm64: Correctly handle end of VA space TLBI invalidation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/kvm/nested.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ce447651a52ec077694172af10c4fffb11f56c43", "status": "affected", "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "versionType": "git"}, {"lessThan": "c624731ca6fe59ad8909ce4108301aa7560a91d6", "status": "affected", "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "versionType": "git"}, {"lessThan": "34af2c3e31f91a739dc175459fdbd99ed952b457", "status": "affected", "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/kvm/nested.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Correctly handle end of VA space TLBI invalidation\n\nOur TLB invalidation by VA code is based on comparing two ranges,\none defined by the TLB, and one defined by the TLBI instruction.\n\nEach range is defined by a start and a size. However, the way the\ncomparison is done doesn't account for address rollover, as it\ncompares an address with (base + size). This works nicely until\nthis expression represent the last page/block in the TTBR1 VA space,\nas the result is a big fat 0. And a failed TLB invalidation.\n\nRewrite the comparison in a way that is immune to the address\nrollover (making the end address inclusive instead of exclusive),\nand move this into a common helper that is used by both VA and IPA\ninvalidations, as suggested by Hyunwoo Kim (although the IPA version\ndidn't suffer from this particular problem, obviously)."}], "id": "CVE-2026-89918", "lastModified": "2026-09-16T15:18:18.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:17:00.867", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/34af2c3e31f91a739dc175459fdbd99ed952b457"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c624731ca6fe59ad8909ce4108301aa7560a91d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce447651a52ec077694172af10c4fffb11f56c43"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}