Executive brief
A flaw in the Linux kernel's KVM hypervisor (for ARM64 processors) could cause virtual TLB caches to fail to invalidate properly in nested virtualization scenarios. An attacker with control of a guest virtual machine could exploit this to bypass memory isolation controls, potentially accessing or corrupting data from other VMs or the host system.
Technical details
The vulnerability exists in KVM's ARM64 nested virtualization code, specifically in the VNCR (Virtual Nested Control Register) mapping counter logic used to optimize TLB invalidation decisions. The flaw is a logic error: the code relies on a global counter to decide whether TLB invalidations are needed, but this counter can become out of sync with actual state. Specifically, (1) TLB invalidation and VNCR mapping are independent, yet the code treats the counter as a proxy for whether invalidation is required, potentially causing missed invalidations; (2) when a vCPU invalidates its own TLB, the VNCR page may not be mapped in the hypervisor at that moment, causing the invalidation to fail silently. The fix removes the flawed optimization entirely, ensuring all TLB invalidation requests are properly processed. The vulnerability requires local access to a guest VM and affects any system using KVM with nested virtualization on ARM64.
Affected products
- Linux Linux kernel Affected versions in KVM arm64 nested virtualization code; patch released in upstream commit c55bc773b6e814406658fae7dc5c15f639ed816e
Timeline
- 2026-09-16: disclosed: CVE-2026-89915 published
- 2026-08-06: patched: Upstream commit c55bc773b6e814406658fae7dc5c15f639ed816e by Marc Zyngier