{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89911", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.774Z", "datePublished": "2026-09-16T10:32:08.598Z", "dateUpdated": "2026-09-16T14:40:01.708Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T14:40:01.708Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Correctly cap TLBI Range to the architural limit\n\nTLB Invalidation by Range has a fairly powerful way of encoding pretty\nlarge ranges in a small number of bits. This range can be based on an\narbitrary VA, which means it is pretty easy for a guest to generate an\noverflow should the hypervisor be naive enough to add the range to the\nbase...\n\nMake sure the range is capped to the limit dictated by the address bit\nthat determines the VA range. For an IPA invalidation, this is further\ncorrected down the line to ignore the upper range."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "baseScore": 7.9, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - A nested arm64 guest reaches decode_range_tlbi() by executing a range TLBI (RVAE/RIPAS2 and related encodings) that traps through kvm_handle_sys_reg into handle_tlbi_el2/handle_ripas2e1is; this is local KVM vCPU execution via /dev/kvm, not a network, adjacent, or physical path.\nAC:L - Once nested virt is available (kvm-arm.mode=nested and KVM_ARM_VCPU_HAS_EL2), the guest fully controls the TLBI operand and can deterministically encode a base+range that overflows the VA half-space; no race or attacker-uncontrollable timing is required.\nPR:L - The attacker must run code in a nested-capable KVM guest or create such a VM through /dev/kvm (typically kvm-group). That is low privilege relative to the host; the emulated TLBI path does not require init-namespace root.\nUI:N - After the nested VM is running, exploitation is triggered solely by the guest executing the range TLBI; no additional host-user or victim action is required.\nS:C - The bug is in KVM\u2019s nested-virtualization TLB/VNCR handling: an L1 TLBI is misapplied by L0, so host-maintained VNCR and related nested MMU state is not invalidated, crossing the guest/hypervisor security boundary.\nC:L - A wrapping range causes missed VNCR invalidation, so L0 may keep using a stale guest page for EL2 sysreg state and expose that bounded nested-hypervisor data to a page L1 believed unmapped (for example reused by L2). This is not an arbitrary host-memory read.\nI:L - The host may keep writing nested EL2 sysreg state through the stale VNCR mapping into a guest page that should have been invalidated, corrupting bounded nested-virt state rather than providing an arbitrary host write or control-flow hijack.\nA:H - Failed range invalidation leaves stale nested translations that can crash or hang the nested hypervisor or L2 workload, and the guest can repeat the TLBI at will, which is a complete availability loss for that nested VM."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/kvm_nested.h"], "versions": [{"version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "lessThan": "566b1f08d983615f731cc693f2ad59db302c6b57", "status": "affected", "versionType": "git"}, {"version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "lessThan": "2de38f0448b45d27eba984fc0d9edb7a138972c2", "status": "affected", "versionType": "git"}, {"version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "lessThan": "69a598288195947a1662b53de702eb6976af96b7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/kvm_nested.h"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/566b1f08d983615f731cc693f2ad59db302c6b57"}, {"url": "https://git.kernel.org/stable/c/2de38f0448b45d27eba984fc0d9edb7a138972c2"}, {"url": "https://git.kernel.org/stable/c/69a598288195947a1662b53de702eb6976af96b7"}], "title": "KVM: arm64: Correctly cap TLBI Range to the architural limit", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/include/asm/kvm_nested.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "566b1f08d983615f731cc693f2ad59db302c6b57", "status": "affected", "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "versionType": "git"}, {"lessThan": "2de38f0448b45d27eba984fc0d9edb7a138972c2", "status": "affected", "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "versionType": "git"}, {"lessThan": "69a598288195947a1662b53de702eb6976af96b7", "status": "affected", "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/include/asm/kvm_nested.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Correctly cap TLBI Range to the architural limit\n\nTLB Invalidation by Range has a fairly powerful way of encoding pretty\nlarge ranges in a small number of bits. This range can be based on an\narbitrary VA, which means it is pretty easy for a guest to generate an\noverflow should the hypervisor be naive enough to add the range to the\nbase...\n\nMake sure the range is capped to the limit dictated by the address bit\nthat determines the VA range. For an IPA invalidation, this is further\ncorrected down the line to ignore the upper range."}], "id": "CVE-2026-89911", "lastModified": "2026-09-16T15:18:17.300", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 5.3, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:17:00.127", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2de38f0448b45d27eba984fc0d9edb7a138972c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/566b1f08d983615f731cc693f2ad59db302c6b57"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/69a598288195947a1662b53de702eb6976af96b7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}