CVE-2026-89916 Overview
CVE-2026-89916 is a race condition in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for arm64. The flaw resides in the Virtual Nested Control Register (VNCR) TLB invalidation path, which fails to participate in Memory Management Unit (MMU) invalidation retry logic. Concurrent vCPUs can insert stale Translation Lookaside Buffer (TLB) entries after another vCPU has invalidated the corresponding Stage-1 page tables. The condition affects guest virtualization integrity on arm64 hosts running nested virtualization workloads.
Critical Impact
A local attacker with the ability to run code inside a KVM guest on an arm64 host can trigger memory corruption or elevate privileges through stale TLB entries pointing to freed or reassigned pages.
Affected Products
- Linux kernel (arm64 KVM subsystem with nested virtualization support)
- Distributions shipping vulnerable kernel versions prior to the fix commits
- Stable kernel branches receiving backports referenced in the patch series
Discovery Timeline
- 2026-09-16 - CVE-2026-89916 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89916
Vulnerability Analysis
The vulnerability is a race condition [TOCTOU-class] between VNCR TLB invalidation and concurrent page table walks in arch/arm64/kvm. The VNCR mechanism accelerates access to nested virtualization control registers by caching Stage-1 (S1) translations. When two vCPUs operate concurrently, one walking page tables and one invalidating them, the invalidation path does not coordinate with the MMU notifier retry sequence.
The result is that vCPU A can walk the S1 page tables to translate a VNCR virtual address, and before it acquires the MMU lock to install the TLB entry, vCPU B updates the same S1 page tables with an invalid entry and issues a TLBI S1E2 instruction. vCPU A then proceeds to install a TLB entry that references translations no longer valid, effectively pointing to memory that may have been repurposed.
Root Cause
The root cause is that invalidate_vncr_va() did not increment mmu_invalidate_seq, the sequence counter used by MMU notifiers to signal that mappings have changed. Without bumping this counter, faulting vCPUs have no way to detect that the S1 context has shifted mid-walk and cannot replay the fault. The Stage-2 (S2) path already handled this correctly through the standard MMU notifier flow.
Attack Vector
Exploitation requires local access with the ability to execute code inside a KVM guest on an arm64 host with nested virtualization enabled. An attacker orchestrates concurrent vCPU threads: one performs VNCR-triggering accesses while another rapidly invalidates the same virtual address ranges. Winning the race yields a TLB entry that maps a guest-controlled virtual address to a stale physical frame, enabling escalation across the hypervisor boundary.
The vulnerability is described in prose only; refer to the upstream commits 11ee3fa, 2b7324f3, and d8580e7a for the exact patch semantics. See the Kernel Patch Commit 11ee3fa for the primary fix.
Detection Methods for CVE-2026-89916
Indicators of Compromise
- Unexpected KVM guest crashes or hypervisor-reported memory faults on arm64 hosts running nested virtualization workloads.
- Kernel log entries referencing arm64 KVM VNCR handling, Stage-1 TLB invalidations, or MMU notifier retries under load.
- Guest workloads exhibiting inconsistent memory reads correlated with heavy vCPU concurrency.
Detection Strategies
- Inventory arm64 hosts running KVM with nested virtualization enabled and correlate kernel versions against the fixed commits.
- Monitor dmesg and journal output for oops, warnings, or panics originating from arch/arm64/kvm code paths.
- Deploy runtime endpoint telemetry on Linux hypervisor hosts to capture kernel-level anomalies and correlate with guest-side behavior.
Monitoring Recommendations
- Enable kernel audit logging for KVM-related subsystems and forward events to a centralized SIEM or data lake for correlation.
- Track unprivileged user creation of KVM guests and monitor for abnormal vCPU thread patterns that could indicate race exploitation attempts.
- Baseline normal MMU notifier activity on hypervisor hosts to detect sustained invalidation storms targeting the same virtual address ranges.
How to Mitigate CVE-2026-89916
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 11ee3faab4f1755d126bead9f882e75a7a677860, 2b7324f3a0c1072b9d578b8d42f199506753f26e, and d8580e7aa189b0c6c5bb4d94b8352728a7c35bbd.
- Update distribution kernels on arm64 hypervisor hosts to versions incorporating the fix as soon as vendor packages are available.
- Restrict local access to hypervisor hosts and audit which tenants can create and run KVM guests with nested virtualization.
Patch Information
The fix extends invalidate_vncr_va() to increment mmu_invalidate_seq under the MMU write lock so that concurrent fault handlers observe the sequence change and replay the fault. Faulting vCPUs sample the sequence number before walking S1 and abort installation of a stale TLB entry when the counter has advanced. Patches are published in the mainline and stable kernel trees at Kernel Patch Commit 2b7324f3 and Kernel Patch Commit d8580e7a.
Workarounds
- Disable nested virtualization on arm64 KVM hosts where the feature is not required until patched kernels are deployed.
- Reduce vCPU counts and constrain untrusted workloads on affected hosts to lower the practical exploitability of the race window.
- Migrate sensitive workloads to unaffected hypervisor architectures or already-patched hosts pending remediation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.