CVE-2026-89914: Linux Kernel KVM Privilege Escalation Flaw

CVE-2026-89914 Overview

CVE-2026-89914 is a sign-extension error in the Linux kernel's Kernel-based Virtual Machine (KVM) implementation for the arm64 architecture. The flaw affects the decode_range_tlbi() helper used for range-based Translation Lookaside Buffer Invalidation (TLBI). When the helper was extended to handle Stage-1 (S1) TLBIs, developers omitted the required sign extension of the virtual address (VA). The missing sign extension causes incorrect address decoding during TLB invalidation and requires additional care to avoid overflowing physical address (PA) bits when reused for Stage-2 (S2) invalidation. The Linux kernel maintainers have resolved the issue in stable branches.

Critical Impact
A local attacker on an arm64 host running KVM guests can trigger incorrect TLB invalidation, leading to memory corruption and full compromise of confidentiality, integrity, and availability.

Affected Products

Linux kernel arm64 KVM subsystem (versions containing the modified decode_range_tlbi() helper)
Systems running virtualization workloads on 64-bit ARM hosts
Distributions shipping kernels prior to the fix commits 2393470, 3feb839, and 72bce82

Discovery Timeline

2026-09-16 - CVE-2026-89914 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89914

Vulnerability Analysis

The vulnerability lives in decode_range_tlbi(), an arm64 KVM helper that decodes range-based TLB invalidation operations. Range-based TLBI instructions encode a base virtual address plus scale and number fields to invalidate contiguous translation entries efficiently. When the helper was repurposed to also handle Stage-1 invalidations, the code path that reconstructs the virtual address from the encoded operand no longer applied sign extension. Because arm64 virtual addresses are canonical, encoding a high-half kernel or hypervisor address requires the upper bits to be filled with the sign bit. Without sign extension, the decoded address is truncated to a non-canonical form. The kernel then issues invalidation against an incorrect address range, leaving stale translations in the TLB or invalidating unintended entries.

Root Cause

The defect is a sign-extension error [CWE-194 class] introduced when decode_range_tlbi() was generalized from Stage-2 to also cover Stage-1 use. The helper truncates the reconstructed VA rather than propagating the top bit. Compounding the issue, the fix note calls out that S2 callers must now guard against overflowing PA bits when using the same routine.

Attack Vector

Exploitation requires local access to an arm64 host running KVM. A malicious guest or unprivileged process capable of triggering the vulnerable invalidation path can cause the hypervisor to skip flushing translations for a targeted address range. Stale TLB entries can then be used to read or write memory the guest should not access, enabling privilege escalation from guest to host or cross-guest memory disclosure. The scope-change property of the vulnerability reflects this crossing of the virtualization boundary. Public exploit code is not available at the time of publication.

No verified proof-of-concept code has been released. See the upstream fix commits referenced below for the exact code path and remediation.

Detection Methods for CVE-2026-89914

Indicators of Compromise

Unexpected kernel oops or KVM warnings referencing __kvm_tlb_flush_vmid_range or related arm64 TLB invalidation paths
Guest virtual machines exhibiting memory corruption, unexplained crashes, or data inconsistencies without corresponding application errors
Host kernel logs showing anomalous Stage-2 fault patterns immediately after guest TLBI operations

Detection Strategies

Inventory arm64 hosts and compare running kernel versions against the fixed commits 2393470, 3feb839, and 72bce82
Monitor dmesg and hypervisor telemetry on arm64 KVM hosts for TLB invalidation anomalies and unexpected guest exits
Correlate guest and host memory-integrity alerts across virtualization clusters to surface cross-tenant anomalies

Monitoring Recommendations

Enable kernel audit logging on virtualization hosts and forward it to a central analytics platform for anomaly detection
Track guest lifecycle events, especially unexplained reboots or hangs, that could indicate exploitation attempts
Alert on privileged process creation and kernel module loading on KVM hosts to catch post-exploitation activity

How to Mitigate CVE-2026-89914

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 2393470, 3feb839, and 72bce82 to all arm64 KVM hosts
Update to distribution kernel packages that incorporate the fix as soon as vendors publish them
Restrict local and guest access on affected hypervisors until patching is complete

Patch Information

The Linux kernel community resolved the issue by restoring sign extension inside decode_range_tlbi() and documenting the PA-overflow constraint for Stage-2 callers. Refer to the fix commits at Kernel Git Commit 2393470, Kernel Git Commit 3feb839, and Kernel Git Commit 72bce82.

Workarounds

Disable KVM on affected arm64 hosts where virtualization is not required until the patched kernel is deployed
Limit guest workloads to trusted tenants and prevent execution of untrusted code inside guests
Enforce strict least-privilege on host user accounts to reduce local attack surface

bash

# Verify kernel version and confirm the fix is present
uname -r
# Check whether the patched commit is in the running kernel source tree
git -C /usr/src/linux log --oneline | grep -E "2393470|3feb839|72bce82"
# Disable KVM module as a temporary mitigation on arm64
sudo modprobe -r kvm