Executive brief
The Linux kernel's KVM (virtual machine) implementation on ARM64 processors contains a logic error in how it validates memory address ranges during TLB (translation lookaside buffer) invalidation operations. An attacker could exploit this to bypass address validation checks, potentially allowing unauthorized memory access or privilege escalation within virtualized environments. This affects systems running KVM on ARM64-based infrastructure.
Technical details
The vulnerability exists in the decode_range_tlbi() helper function used by KVM's arm64 nested virtualization code. When this function was refactored to support Stage 1 TLB invalidations, required sign-extension logic for virtual addresses was omitted. This causes decoded addresses to remain incorrectly zero-padded instead of properly sign-extended to 64-bit values, allowing crafted TLBI (TLB Invalidation) instructions to bypass the physical address (PA) bounds checking in handle_ripas2e1is(). An attacker with ability to execute hypervisor-level instructions in a guest VM could craft malicious TLBI range invalidation operations that overflow PA bit boundaries. The fix adds sign-extension to bit 48 for VA/IPA values and adds explicit PA bounds validation to cap invalidation ranges. No public exploits are known, but the critical CVSS score reflects the potential for privilege escalation in nested virtualization scenarios.
Affected products
- Linux Linux kernel Various versions with KVM arm64 nested virtualization support; patched in commit 2393470085649f0b973ecceb26fe8fc71edde0c1 and backported to stable branches
Timeline
- 2026-09-16: disclosed: CVE-2026-89914 published
- 2026-08-08: patched: Fix merged upstream in commit 2393470085649f0b973ecceb26fe8fc71edde0c1
- 2026-09-11: patched: Backported to stable kernel branches