Junglewise Threat Intelligence

CVE-2026-89917: Linux kernel KVM arm64 VNCR TLB invalidation race condition

CVE-2026-89917 · Severity: info · CVSS 0 · Published 2026-09-16

Executive brief

The Linux kernel's ARM64 KVM hypervisor contains a race condition in VNCR (Virtual Nested Configuration Register) TLB invalidation handling. Concurrent execution paths between memory unmapping operations and TLB invalidation can cause kernel crashes (BUG_ON failures) or memory corruption. This affects systems using nested virtualization on ARM64 platforms where multiple virtual CPUs interact with shared memory structures.

Technical details

The vulnerability is a time-of-check-to-time-of-use (TOCTOU) race in the KVM arm64 nested virtualization code, specifically in VNCR TLB invalidation. The root cause is that vncr_tlb::cpu field access is not properly synchronized between invalidate_vncr() (which holds the MMU lock) and this_cpu_reset_vncr_fixmap() (called from vcpu_put() without the MMU lock). The invalidation path checks if cpu != -1 before unmapping, while vcpu_put() unconditionally unmaps if L1_VNCR_MAPPED is set, leading to double-unmap conditions or use-after-free. The fix converts vncr_tlb::cpu to an atomic_t and introduces unmap_l1_vncr() function using atomic_xchg_relaxed() to ensure only one thread successfully resets the field and performs the unmap, preventing concurrent manipulation of the same mapping.

Affected products

  • Linux Linux kernel 5.14 and later with ARM64 KVM nested virtualization support

Timeline

  • 2026-09-16: disclosed
  • 2026-08-08: patched: Fix committed upstream by Oliver Upton

References

Related threats