Look up another CVE · open CVE-2026-89918 in the interactive tracker
CVE-2026-89918
KVM: arm64: Correctly handle end of VA space TLBI invalidation
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem arch/arm64. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-89918 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start and a size. However, the way the comparison is done doesn't account for address rollover, as it compares an address with (base + size). This works nicely until this expression represent the last page/block in the TTBR1 VA space, as the result is a big fat 0. And a failed TLB invalidation. Rewrite the comparison in a way that is immune to the address rollover (making the end address inclusive instead of exclusive), and move this into a common helper that is used by both VA and IPA invalidations, as suggested by Hyunwoo Kim (although the IPA version didn't suffer from this particular problem, obviously).
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/arm64/kvm/nested.c
- What this is
- KERNEL VIRTUAL MACHINE FOR ARM64 (KVM/arm64)MAINTAINERS section matched on arch/arm64/kvm/ · linux-arm-kernel@lists.infradead.org · Maintained
- Kernel module
- kvm
Check it on the machine
grep -w CONFIG_KVM /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w kvmPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixieBnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- forky, sidBnot built on armhf/armmp, armhf/armmp-lpae
- ?
- not established - no Makefile entry for the affected file
- B
- built in on some, a module on others, absent on the rest
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_KVM
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 9.3 critical
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.19%, higher than 8.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/arm64
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.16 | 6.18.51 | ce447651a52e |
| 6.16 | 7.2.5 | c624731ca6fe |
| 6.16 | 7.3 | 34af2c3e31f9 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached when an arm64 nested-KVM L1 hypervisor executes EL2/EL1 TLBI-by-VA instructions that trap into KVM_RUN and run handle_tlbi_el2()/handle_tlbi_el1() → kvm_handle_s1e2_tlbi() → invalidate_vncr_va(); no network, adjacent-radio, or physical-device path reaches this VNCR pseudo-TLB comparison.
- AC:LAttack complexity, low
- An attacker controlling an L1 nested hypervisor can place VNCR_EL2 on the last TTBR1 page or issue a VA-scoped TLBI for that range so base+size wraps to 0, causing a deterministic missed invalidation; nested virt on arm64 cloud hosts is an attacker-selectable deployment, not an uncontrollable condition.
- PR:NPrivileges required, none
- Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.
- UI:NUser interaction, none
- No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR placement, stage-1 remaps, and TLBI-by-VA issuance are fully attacker-driven from within the guest.
- S:CScope, changed
- Failed VNCR pseudo-TLB invalidation leaves the host kernel's per-CPU fixmap aliasing a stale guest physical page for nested EL2 register state, so the hypervisor reads and writes the wrong memory after the guest remaps that VA, crossing the guest-to-hypervisor security boundary.
- C:HConfidentiality impact, high
- A missed invalidation keeps a host PAGE_KERNEL fixmap to the old HPA after the L1 remaps VNCR_EL2, so KVM continues to read nested EL2 register state from a guest page that should no longer back VNCR, disclosing hypervisor-viewed contents across the stale translation.
- I:HIntegrity impact, high
- The same stale writable fixmap lets the host write nested EL2 register values into a guest page the L1 has already remapped or reused, and lets the guest inject attacker-controlled EL2 sysreg contents through the old page while KVM trusts it as VNCR, corrupting hypervisor-emulated nested state.
- A:HAvailability impact, high
- Stale VNCR translations leave host KVM and FEAT_NV2 hardware using inconsistent nested EL2 state and the wrong guest page, which can crash or livelock the host nested-virt paths and deny service to co-resident VMs on the hypervisor.