CVE-2026-89915: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89915 Overview

CVE-2026-89915 is a Linux kernel vulnerability in the KVM (Kernel-based Virtual Machine) subsystem for arm64. The flaw resides in the nested virtualization VNCR (Virtual Nested Control Register) page handling logic. A VM-wide VNCR mapping counter was used to decide whether TLB (Translation Lookaside Buffer) invalidations were required, but the tracking failed to deliver the minimum correctness guarantees. Missed invalidations can allow an L1 guest vCPU to operate against stale TLB state on the host. The upstream fix removes the counter-based optimization entirely.

Critical Impact

Missed TLB invalidations in KVM nested virtualization on arm64 hosts can lead to memory state inconsistencies affecting confidentiality, integrity, and availability of the virtualization host.

Affected Products

• Linux kernel with KVM arm64 nested virtualization enabled
• Distributions shipping kernels containing the VM-wide VNCR mapping counter logic
• arm64 hosts running L1 guests that use VNCR pages

Discovery Timeline

• 2026-09-16 - CVE-2026-89915 published to the National Vulnerability Database (NVD)
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89915

Vulnerability Analysis

The vulnerability affects KVM arm64 nested virtualization, specifically the handling of VNCR pages provided by an L1 hypervisor guest. KVM maintained a global counter tracking whether an L1-provided VNCR page was mapped into the L0 (host) fixmap on any CPU. The counter was consulted during TLB invalidation to decide whether the VNCR pseudo TLB entries needed to be flushed. This design conflated the presence of a fixmap mapping with the need for TLB invalidation, producing incorrect results.

This is a kernel-level correctness flaw in a virtualization boundary [CWE-Kernel Vulnerability]. Because the incorrect decision affects TLB state used across nested guest transitions, host memory translations can diverge from expected values.

Root Cause

The counter tracked mapping lifecycle rather than TLB residency. It was incremented when a mapping was created in the fixmap and decremented when the mapping was torn down. TLB entries can persist independently of whether the mapping is currently installed. Checking the counter to gate invalidation therefore permitted TLB invalidations to be skipped when they were still required.

A concrete failure mode occurs when an L1 vCPU invalidates its own TLB. In that common path, the VNCR page is not mapped in L0 at the time of invalidation, so the counter check causes KVM to skip flushing the VNCR pseudo TLB. Stale translations remain valid across guest execution.

Attack Vector

The attack vector is local. An attacker requires the ability to run code inside an L1 guest that exercises nested virtualization on an arm64 KVM host. By manipulating VNCR mappings and issuing TLB invalidations, the attacker can leave stale translations in place. The consequences include memory state inconsistencies between nested guest levels, with potential impact to host memory integrity.

The vulnerability manifests inside KVM's arm64 nested virtualization TLB handling code. See the upstream commits for the exact code paths affected: Kernel Git Commit 5453b85, Kernel Git Commit 87c2bbf, and Kernel Git Commit c55bc77.

Detection Methods for CVE-2026-89915

Indicators of Compromise

• No public indicators of compromise are documented for this vulnerability at this time.
• Anomalous nested guest crashes or memory corruption on arm64 KVM hosts running L1 hypervisors may warrant investigation.

Detection Strategies

• Inventory arm64 hosts running KVM with nested virtualization enabled and compare running kernel versions against distribution advisories referencing the upstream commits.
• Audit kernel package versions across virtualization hosts to identify unpatched builds containing the VM-wide VNCR mapping counter code path.
• Monitor for unexpected guest instability or translation faults on arm64 nested virtualization workloads.

Monitoring Recommendations

• Track kernel version drift on arm64 virtualization infrastructure and alert on hosts running vulnerable builds.
• Forward dmesg and KVM subsystem logs to a central log store for review of nested virtualization errors.
• Correlate guest crash telemetry with host kernel versions to identify patterns consistent with TLB inconsistencies.

How to Mitigate CVE-2026-89915

Immediate Actions Required

• Apply the upstream kernel patches that remove the VM-wide VNCR mapping counter and reboot affected arm64 hosts.
• Update to a distribution kernel that incorporates the fixes referenced in the upstream commits.
• Restrict which tenants can launch nested virtualization workloads on arm64 hosts until patches are deployed.

Patch Information

The fix removes the global VNCR mapping counter and its associated gating logic in the KVM arm64 TLB invalidation path. Review and apply the changes from Kernel Git Commit 5453b85, Kernel Git Commit 87c2bbf, and Kernel Git Commit c55bc77. Distribution vendors are expected to backport these commits to supported stable branches.

Workarounds

• Disable nested virtualization on arm64 KVM hosts where it is not required until a patched kernel is installed.
• Limit L1 guest workloads to trusted tenants on affected hosts as a compensating control.
• Segment arm64 virtualization hosts running unpatched kernels away from multi-tenant workloads.