CVE-2026-89911

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap TLBI Range to the architural limit TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means it is pretty easy for a guest to generate an overflow should the hypervisor be naive enough to add the range to the base... Make sure the range is capped to the limit dictated by the address bit that determines the VA range. For an IPA invalidation, this is further corrected down the line to ignore the upper range.

CVSS v3 7.9 HIGH

7.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 5.3

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/2de38f0448b45d27eba984fc0d9edb7a138972c2
https://git.kernel.org/stable/c/566b1f08d983615f731cc693f2ad59db302c6b57
https://git.kernel.org/stable/c/69a598288195947a1662b53de702eb6976af96b7

Configurations

No configuration.

History

16 Sep 2026, 15:18

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.9

Information

Published : 2026-09-16 11:17

Updated : 2026-09-16 15:18

NVD link : CVE-2026-89911

Mitre link : CVE-2026-89911

CVE.ORG link : CVE-2026-89911

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-89911", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 2.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "lessThan": "566b1f08d983615f731cc693f2ad59db302c6b57", "versionType": "git"}, {"status": "affected", "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "lessThan": "2de38f0448b45d27eba984fc0d9edb7a138972c2", "versionType": "git"}, {"status": "affected", "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929", "lessThan": "69a598288195947a1662b53de702eb6976af96b7", "versionType": "git"}], "programFiles": ["arch/arm64/include/asm/kvm_nested.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.51", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.5", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/arm64/include/asm/kvm_nested.h"], "defaultStatus": "affected"}]}], "published": "2026-09-16T11:17:00.127", "references": [{"url": "https://git.kernel.org/stable/c/2de38f0448b45d27eba984fc0d9edb7a138972c2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/566b1f08d983615f731cc693f2ad59db302c6b57", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/69a598288195947a1662b53de702eb6976af96b7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Correctly cap TLBI Range to the architural limit\n\nTLB Invalidation by Range has a fairly powerful way of encoding pretty\nlarge ranges in a small number of bits. This range can be based on an\narbitrary VA, which means it is pretty easy for a guest to generate an\noverflow should the hypervisor be naive enough to add the range to the\nbase...\n\nMake sure the range is capped to the limit dictated by the address bit\nthat determines the VA range. For an IPA invalidation, this is further\ncorrected down the line to ignore the upper range."}], "lastModified": "2026-09-16T15:18:17.300", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}