CVE-2026-89911: Linux Kernel KVM Privilege Escalation Flaw

CVE-2026-89911 Overview

CVE-2026-89911 is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) subsystem for arm64 architectures. The flaw resides in the Translation Lookaside Buffer Invalidation (TLBI) by Range handling, where the hypervisor fails to cap invalidation ranges to the architectural limit. A guest can supply an arbitrary virtual address that, when combined with a range value, overflows the base and produces an out-of-bounds computation. Local authenticated users on the host with access to a virtual machine can trigger the condition to affect host stability.

Critical Impact
A malicious or misbehaving guest can cause arithmetic overflow during TLB invalidation, impacting host availability across the virtualization boundary.

Affected Products

Linux kernel KVM subsystem on arm64
Hypervisor deployments running arm64 guests
Distributions shipping affected kernel versions prior to the referenced stable commits

Discovery Timeline

2026-09-16 - CVE-2026-89911 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89911

Vulnerability Analysis

The vulnerability affects KVM: arm64 TLB Invalidation by Range logic. TLBI Range encoding allows a guest to describe large virtual address ranges using a compact bit representation. The hypervisor code path adds the encoded range to a base virtual address without validating that the sum stays within the architectural VA limit defined by the address bit that determines the VA range.

When a guest issues a TLBI Range operation using a crafted base virtual address, the addition overflows. The result is an invalidation range that exceeds architectural bounds. For Intermediate Physical Address (IPA) invalidations, downstream logic later corrects the upper bound, but the initial range computation remains incorrect and unsafe. This behavior falls into the category of Integer Overflow within a Kernel Vulnerability.

Root Cause

The root cause is missing boundary enforcement in the TLBI Range calculation. The hypervisor accepts a guest-supplied virtual address and range without capping the resulting invalidation window to the maximum permitted by the effective VA size. The fix, applied in kernel commits 2de38f0, 566b1f0, and 69a5982, ensures the computed range is truncated to the architectural limit before use.

Attack Vector

Exploitation requires local access with low privileges inside a guest virtual machine running under KVM on arm64 host hardware. No user interaction is required. A guest kernel invoking crafted TLBI Range operations can trigger the overflow, producing a scope change condition where guest-provided input alters hypervisor-level state. The primary observable impact is high availability disruption to the host, with limited confidentiality and integrity effects.

The vulnerability manifests inside the hypervisor's TLBI Range handling. See the referenced kernel commits for the exact code paths: Kernel Git Commit 2de38f0, Kernel Git Commit 566b1f0, and Kernel Git Commit 69a5982.

Detection Methods for CVE-2026-89911

Indicators of Compromise

Unexpected host kernel warnings, oopses, or soft lockups originating in KVM arm64 TLB invalidation code paths.
Guest virtual machines issuing anomalous volumes of TLBI Range operations with unusually large encoded ranges.
Host instability, hypervisor crashes, or degraded VM performance correlated with a specific guest workload.

Detection Strategies

Compare running kernel versions on arm64 hypervisor hosts against the fixed commits 2de38f0, 566b1f0, and 69a5982.
Enable kernel tracing on KVM arm64 TLBI paths to identify guests generating out-of-range invalidation requests.
Monitor dmesg and hypervisor logs for warnings tied to TLB invalidation and VA range checks.

Monitoring Recommendations

Aggregate host kernel logs from arm64 KVM hypervisors into a central data lake for cross-host correlation.
Alert on repeated KVM error messages, host reboots, or VM exits tied to memory management faults.
Track guest-to-host reliability metrics per tenant to surface guests that consistently degrade host stability.

How to Mitigate CVE-2026-89911

Immediate Actions Required

Inventory all arm64 hypervisor hosts running KVM and identify kernels missing the fix commits.
Apply distribution kernel updates that incorporate commits 2de38f0, 566b1f0, and 69a5982.
Prioritize patching multi-tenant hosts where untrusted guest workloads run alongside sensitive VMs.

Patch Information

The upstream fix caps the TLBI Range to the architectural limit dictated by the VA range address bit. Distributions should backport the three stable commits: Kernel Git Commit 2de38f0, Kernel Git Commit 566b1f0, and Kernel Git Commit 69a5982. Reboot hosts after installing patched kernels to activate the fix.

Workarounds

Restrict guest workloads on unpatched arm64 hypervisors to trusted tenants only.
Migrate untrusted VMs to already-patched hosts using live migration where supported.
Isolate arm64 KVM hosts that cannot be patched immediately from workloads that expose guest kernel control to end users.

bash

# Verify running kernel and inspect for the fix commits after upgrade
uname -r
zcat /proc/config.gz 2>/dev/null | grep -i KVM
dmesg | grep -i -E 'kvm|tlbi'