Look up another CVE · open CVE-2026-89775 in the interactive tracker
CVE-2026-89775
KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem arch/arm64. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-89775 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from the combination of the base granule size and the mapping level. However, this implies that the S1 MMU is *on*. When the MMU is off, we indicate this with the level being set to a "creative" value of -127 (S1_MMU_DISABLED). This ends-up being misinterpreted by pgshift_level_to_ttl() as it doesn't handle negative levels at all (the level is immediately cast to a u8 and only the bottom two bits considered), leading to an invalidation size of 0. Not helpful. Tidy-up pgshift_level_to_ttl() to handle these negative levels, and ttl_to_size() to always return SZ_1G when no valid TTL is present. This allows the removal of open-coded checks for similar situations. Note that the check for a negative value not explicitely checking for S1_MMU_DISABLED is deliberate, so that actual negative levels introduced with LVA2 and D128 can take the same path if we ever support them.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/arm64/kvm/nested.c
- What this is
- KERNEL VIRTUAL MACHINE FOR ARM64 (KVM/arm64)MAINTAINERS section matched on arch/arm64/kvm/ · linux-arm-kernel@lists.infradead.org · Maintained
- Kernel module
- kvm
Check it on the machine
grep -w CONFIG_KVM /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w kvmPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixieBnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- forky, sidBnot built on armhf/armmp, armhf/armmp-lpae
- ?
- not established - no Makefile entry for the affected file
- B
- built in on some, a module on others, absent on the rest
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_KVM
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 9.3 critical
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.23%, higher than 12.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/arm64
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.16 | 6.18.51 | be54a70067c7 |
| 6.16 | 7.2.5 | 1c9fca34b962 |
| 6.16 | 7.3 | 8053393680d4 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- A nested arm64 L1 hypervisor reaches the bug via KVM_RUN when host KVM handles VNCR_EL2 TLB invalidation (MMU notifiers, memslot unmap, or guest EL2 TLBI into kvm_invalidate_vncr_ipa/invalidate_vncr_va). This is local KVM ioctl/guest execution, not a network, adjacent-radio, or physical-device path.
- AC:LAttack complexity, low
- An L1 guest deterministically clears SCTLR_EL2.M and programs TCR_EL2.TG0 to 16KB or 64KB so S1_MMU_DISABLED (-127) is mis-cast as walk level 1 and ttl_to_size() returns 0, skipping all VNCR invalidation. Nested virt on arm64 cloud hosts is an attacker-selectable deployment, not an uncontrollable race.
- PR:NPrivileges required, none
- Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.
- UI:NUser interaction, none
- No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; SCTLR/TCR setup, VNCR faults, guest TLBI, and balloon or memslot-unmap MMU notifiers are fully attacker-driven.
- S:CScope, changed
- Missed VNCR invalidation leaves a writable host per-CPU fixmap covering a guest IPA after the backing page is unmapped, so host KVM keeps reading and writing reused host physical pages while emulating EL2 register state, crossing the guest-to-hypervisor security boundary.
- C:HConfidentiality impact, high
- The stale VNCR pseudo-TLB retains the old HPA and is remapped with PAGE_KERNEL; after MMU-notifier unmap the host reads reused pages through the fixmap during VNCR/sysreg emulation, yielding a use-after-free disclosure primitive across guest and host memory.
- I:HIntegrity impact, high
- Hardware NV2 and kvm_map_l1_vncr() keep a writable kernel mapping of the stale HPA, so nested EL2 register writes land in pages the host already freed and reused, giving a use-after-free write primitive against host kernel or co-resident memory.
- A:HAvailability impact, high
- Accessing an unmapped or reused HPA through the VNCR fixmap can oops or panic the host kernel, and corrupting reused host pages can hang or crash the hypervisor and co-resident VMs; the attacker can retrigger the missed-invalidation sequence.