CVE-2026-89775 Overview
CVE-2026-89775 affects the Linux kernel's KVM (Kernel-based Virtual Machine) implementation on arm64 architecture. The vulnerability resides in the VNCR (Virtual Nested Control Register) TLB (Translation Lookaside Buffer) size evaluation logic. When the Stage 1 MMU (Memory Management Unit) is disabled, the kernel represents this state with a sentinel level value of -127 (S1_MMU_DISABLED). The pgshift_level_to_ttl() function fails to handle negative levels, casting the value to u8 and considering only the lowest two bits. This produces an invalidation size of zero, leading to incorrect TLB invalidation behavior in guest virtual machines.
Critical Impact
A local attacker with guest VM access on an arm64 host can trigger incorrect TLB invalidation behavior in the KVM hypervisor, potentially breaking guest isolation and impacting host confidentiality, integrity, and availability.
Affected Products
- Linux kernel builds with KVM enabled on arm64 architecture
- Systems using nested virtualization with VNCR support
- Distributions shipping affected upstream kernel versions prior to the fix commits
Discovery Timeline
- 2026-09-16 - CVE CVE-2026-89775 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89775
Vulnerability Analysis
The vulnerability originates in the KVM arm64 code path that computes TLB invalidation effects. Computing the effects of a TLB invalidation requires determining the size of the mapping cached by the TLB. For Stage 1 mappings such as VNCR, this size is derived from the base granule size combined with the mapping level.
This derivation assumes the Stage 1 MMU is active. When the MMU is off, the kernel signals this state by setting the level to -127, a value defined as S1_MMU_DISABLED. The pgshift_level_to_ttl() helper does not account for negative levels. It casts the incoming level to an unsigned 8-bit type and evaluates only the lowest two bits, producing a TTL (Translation Table Level) that maps to an invalidation size of zero.
An invalidation of size zero fails to purge stale mappings that the hypervisor believes were flushed. In a nested virtualization scenario, this stale-state condition can affect guest memory translation integrity.
Root Cause
The root cause is improper input validation in pgshift_level_to_ttl() combined with an implicit assumption in ttl_to_size() that a valid TTL is always present. The sentinel value S1_MMU_DISABLED (-127) was never handled by either function, and open-coded checks elsewhere in the code did not compensate consistently.
Attack Vector
Exploitation requires local access to a guest VM running on an affected arm64 KVM host. An attacker who can influence VNCR state transitions and issue TLB invalidation operations can drive the hypervisor into the flawed code path. The Scope is Changed, meaning the impact extends beyond the guest boundary into the host kernel.
The fix updates pgshift_level_to_ttl() to handle negative levels correctly and modifies ttl_to_size() to return SZ_1G whenever no valid TTL is present. The negative-value check is deliberately generic so future extensions such as LVA2 and D128, which introduce legitimate negative levels, will take the same path.
No public proof-of-concept exploit is available. See the Openwall OSS Security Discussion for additional technical details.
Detection Methods for CVE-2026-89775
Indicators of Compromise
- Unexpected guest VM crashes or memory corruption on arm64 KVM hosts running nested virtualization workloads
- Host kernel warnings or oops messages originating from KVM arm64 TLB invalidation code paths
- Anomalous behavior in guest VMs immediately following VNCR-related MMU state transitions
Detection Strategies
- Audit installed kernel versions on arm64 hypervisor hosts and compare against the fix commits 1c9fca3, 8053393, and be54a70
- Monitor dmesg and journald for KVM-related error messages referencing VNCR, TLB invalidation, or Stage 1 MMU events
- Track guest VM stability metrics on arm64 hosts using nested virtualization to identify unexplained instability
Monitoring Recommendations
- Centralize kernel logs from all arm64 KVM hosts to enable correlation of TLB or MMU anomalies across the fleet
- Alert on kernel panic, oops, or WARN_ON events on hypervisor hosts and route them for immediate triage
- Maintain an authoritative inventory of arm64 hosts with nested virtualization enabled to scope patching quickly
How to Mitigate CVE-2026-89775
Immediate Actions Required
- Identify all arm64 systems running KVM with nested virtualization enabled and prioritize them for patching
- Apply the upstream Linux kernel patches referenced by commits 1c9fca3, 8053393, and be54a70 as soon as distribution builds are available
- Restrict local access to guest VMs on affected hosts to trusted operators until patches are deployed
Patch Information
The issue is resolved in the mainline Linux kernel by three commits: Kernel Patch Commit 1c9fca3, Kernel Patch Commit 8053393, and Kernel Patch Commit be54a70. The fix updates pgshift_level_to_ttl() to handle negative levels and modifies ttl_to_size() to return SZ_1G when no valid TTL is present. Consult your Linux distribution vendor for backported stable-tree releases.
Workarounds
- Disable nested virtualization on arm64 KVM hosts where operationally feasible until patched kernels are deployed
- Limit guest workloads on affected hosts to trusted tenants only
- Increase monitoring of kernel logs for TLB and MMU anomalies on unpatched hypervisor hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
