{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89914", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.774Z", "datePublished": "2026-09-16T10:32:10.631Z", "dateUpdated": "2026-09-16T14:40:06.342Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T14:40:06.342Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Sign-extend VA for range-based TLBI invalidation\n\nWhen the decode_range_tlbi() helper was moved to be used for S1 TLBIs,\nthe required sign extension was omitted. Add it.\n\nAs a result, special care must be taken to not overflow PA bits when\nthis is used for S2 invalidation."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:L - A nested arm64 L1 hypervisor reaches decode_range_tlbi() by executing a range TLBI (RVAE2/RVAE1/RIPAS2 and variants) that traps via ESR_ELx_EC_SYS64 into kvm_handle_sys_reg during KVM_RUN. This is local guest execution, not a network, adjacent-radio, or physical-device path.\nAC:L - An L1 guest fully controls the TLBI Xt encoding (BASEADDR/TG/NUM/SCALE) and can deterministically hit the missing sign-extension for canonical high VAs. Nested virt and FEAT_TLBIRANGE on arm64 cloud hosts are attacker-selectable deployments, not an uncontrollable race or rare kernel config.\nPR:N - Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR_EL2 setup, S1 page-table updates, and EL2 range TLBIs are fully attacker-driven from the guest.\nS:C - Missed high-VA VNCR invalidation leaves the host per-CPU PAGE_KERNEL fixmap covering a stale guest HPA while KVM emulates nested EL2 register state, crossing the guest-to-hypervisor security boundary (Changed per CNA KVM guidance).\nC:H - Without sign_extend64(base, 48), range TLBIs for canonical high GVAs never match vt->gva, so the VNCR pseudo-TLB retains the old HPA; host KVM then reads that physical page through the kernel fixmap during sysreg emulation, disclosing whatever now backs that HPA.\nI:H - kvm_map_l1_vncr() installs a writable PAGE_KERNEL fixmap of the stale HPA when S1 write permissions allow, so nested EL2 register writes land in pages the guest already rebound, giving a write primitive against host-managed physical memory.\nA:H - Accessing an unmapped or reused HPA through the VNCR fixmap can oops or panic the host kernel, and corrupting emulated EL2 state or leaving stale nested translations can hang or crash the hypervisor and co-resident VMs; the attacker can retrigger the range TLBI."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/kvm_nested.h", "arch/arm64/kvm/sys_regs.c"], "versions": [{"version": "85bba00425ae0b4b30938ebfdde6d986e5423aff", "lessThan": "72bce82c4171bf330919ff1b64dc0a36c254ec7d", "status": "affected", "versionType": "git"}, {"version": "85bba00425ae0b4b30938ebfdde6d986e5423aff", "lessThan": "3feb83918e30f0472e058224b926ebfe8a064fac", "status": "affected", "versionType": "git"}, {"version": "85bba00425ae0b4b30938ebfdde6d986e5423aff", "lessThan": "2393470085649f0b973ecceb26fe8fc71edde0c1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/kvm_nested.h", "arch/arm64/kvm/sys_regs.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/72bce82c4171bf330919ff1b64dc0a36c254ec7d"}, {"url": "https://git.kernel.org/stable/c/3feb83918e30f0472e058224b926ebfe8a064fac"}, {"url": "https://git.kernel.org/stable/c/2393470085649f0b973ecceb26fe8fc71edde0c1"}], "title": "KVM: arm64: Sign-extend VA for range-based TLBI invalidation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/include/asm/kvm_nested.h", "arch/arm64/kvm/sys_regs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "72bce82c4171bf330919ff1b64dc0a36c254ec7d", "status": "affected", "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff", "versionType": "git"}, {"lessThan": "3feb83918e30f0472e058224b926ebfe8a064fac", "status": "affected", "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff", "versionType": "git"}, {"lessThan": "2393470085649f0b973ecceb26fe8fc71edde0c1", "status": "affected", "version": "85bba00425ae0b4b30938ebfdde6d986e5423aff", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/include/asm/kvm_nested.h", "arch/arm64/kvm/sys_regs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Sign-extend VA for range-based TLBI invalidation\n\nWhen the decode_range_tlbi() helper was moved to be used for S1 TLBIs,\nthe required sign extension was omitted. Add it.\n\nAs a result, special care must be taken to not overflow PA bits when\nthis is used for S2 invalidation."}], "id": "CVE-2026-89914", "lastModified": "2026-09-16T15:18:17.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:17:00.443", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2393470085649f0b973ecceb26fe8fc71edde0c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3feb83918e30f0472e058224b926ebfe8a064fac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72bce82c4171bf330919ff1b64dc0a36c254ec7d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}