CVE-2026-89917 Overview
CVE-2026-89917 is a race condition in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for arm64. The flaw affects the handling of Virtual Nested Control Register (VNCR) Translation Lookaside Buffer (TLB) invalidation when it races with VNCR page unmapping in vcpu_put(). VNCR TLB invalidation runs under the Memory Management Unit (MMU) lock, but vcpu_put() unmaps the VNCR page without holding that lock. The mismatch creates a Time-of-Check Time-of-Use (TOCTOU) window and can trigger a BUG_ON() in the kernel, with both paths potentially invoking vncr_fixmap(-1).
Critical Impact
The race condition can crash the host kernel through a BUG_ON() assertion and lead to incorrect fixmap unmapping in arm64 KVM nested virtualization scenarios.
Affected Products
- Linux kernel with KVM arm64 nested virtualization support (VNCR feature)
- Distributions shipping affected upstream kernel versions prior to the fix commits
- ARM64 hypervisor hosts running nested guests
Discovery Timeline
- 2026-09-16 - CVE CVE-2026-89917 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89917
Vulnerability Analysis
The defect resides in the arm64 KVM code that manages VNCR page mappings for nested virtualization. The TLB invalidation path evaluates vncr_tlb::cpu to decide whether an unmap must occur, proceeding only when the value is not -1. In parallel, this_cpu_reset_vncr_fixmap() unconditionally unmaps whenever L1_VNCR_MAPPED is set. Because the invalidation runs under the MMU lock while vcpu_put() does not, two threads can observe stale state simultaneously.
The result is a classic TOCTOU pattern. One CPU checks vncr_tlb::cpu, another concurrently resets it, and both attempt the unmap. The kernel triggers a BUG_ON() on the vcpu_put() path, and both paths can call vncr_fixmap(-1), dereferencing an invalid CPU index and producing further corruption of the per-CPU fixmap state.
Root Cause
The root cause is inconsistent locking discipline around a shared field. The vncr_tlb::cpu variable is read and written from paths with differing synchronization guarantees. Without atomic updates or a single well-defined reset point, concurrent invalidation and teardown can interleave and corrupt VNCR fixmap bookkeeping.
Attack Vector
Exploitation requires the ability to run guests on an arm64 host with KVM nested virtualization enabled. A local attacker with the ability to schedule vCPUs and trigger TLB invalidations in parallel with vCPU migration or teardown could race the two code paths. The primary observable outcome is a host kernel panic through the BUG_ON() assertion, resulting in denial of service on the hypervisor.
The upstream fix moves the reset of vncr_tlb::cpu to -1 into a common function and performs the update atomically, ensuring only one thread performs the unmap. The vcpu_put() path is also updated to unconditionally unmap the current VNCR, and the assignment of vncr_tlb::cpu is kept in sync with the actual mapping. See the kernel commit 38640bc32be3 for the applied patch.
Detection Methods for CVE-2026-89917
Indicators of Compromise
- Kernel panics or BUG_ON() traces originating from arm64 KVM VNCR code paths, particularly around vncr_fixmap, vcpu_put, or this_cpu_reset_vncr_fixmap
- Unexpected host reboots on arm64 hypervisors running nested guests
- Kernel log entries referencing vncr_tlb state inconsistencies
Detection Strategies
- Audit installed kernel package versions across arm64 hypervisor fleets and compare against the fixed stable kernel commits
- Monitor dmesg and journalctl -k for VNCR-related stack traces on hosts running nested virtualization
- Correlate host crash dumps with workloads that exercise arm64 nested KVM to identify affected systems
Monitoring Recommendations
- Forward kernel log data to a centralized logging platform and alert on BUG_ON or Oops signatures containing KVM arm64 symbols
- Track hypervisor uptime and crash frequency as a signal for possible race triggers
- Inventory arm64 hosts with CONFIG_KVM and nested virtualization enabled to scope patch priority
How to Mitigate CVE-2026-89917
Immediate Actions Required
- Identify arm64 hosts running KVM with nested virtualization and prioritize them for kernel updates
- Apply the upstream stable kernel patches referenced in the NVD entry as soon as vendor builds are available
- Restrict who can launch nested guests on unpatched hosts to reduce local attack surface
Patch Information
The fix is available in the following upstream commits: 38640bc32be3, 5cbd8761d001, and 9065c1261f8a. Distribution maintainers backport these changes into their respective stable kernel branches. Administrators should track their distribution's security advisories and update to the first kernel build containing all three commits.
Workarounds
- Disable nested virtualization on arm64 KVM hosts until the patched kernel is deployed
- Limit vCPU migration and hot-unplug operations on affected hosts to reduce the likelihood of hitting the race window
- Isolate untrusted tenants from arm64 hypervisors that have not received the fix
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
