CVE-2026-89981: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89981 Overview

CVE-2026-89981 is a Linux kernel vulnerability in the arm64 CPU feature initialization path. The function __cpuinfo_store_cpu() reads the GMID_EL1 system register based on the raw ID_AA64PFR1_EL1 value, even when the kernel has disabled Memory Tagging Extension (MTE) through CONFIG_ARM64_MTE=n or the arm64.nomte command-line override. Under protected KVM (pKVM), the hypervisor sets HCR_EL2.TID5 and injects an undefined instruction exception that the host cannot handle, triggering a kernel panic.

Critical Impact
A CPU hotplug event on a pKVM host with MTE disabled crashes the kernel with an undefined instruction oops, resulting in denial of service.

Affected Products

Linux kernel arm64 architecture with pKVM enabled
Kernels built with CONFIG_ARM64_MTE=n
Kernels booted with the arm64.nomte command-line override

Discovery Timeline

2026-09-16 - CVE-2026-89981 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89981

Vulnerability Analysis

The issue is a kernel oops [CWE-476-style undefined instruction handling failure] in the arm64 CPU feature detection code. During per-CPU initialization, __cpuinfo_store_cpu() inspects ID_AA64PFR1_EL1 to decide whether MTE registers are present. It reads GMID_EL1 when the raw hardware value advertises MTE, ignoring the fact that the kernel itself may have disabled MTE at build time or via the command line.

On a pKVM host, the hypervisor sets HCR_EL2.TID5 when MTE is disabled for the host. That trap bit causes GMID_EL1 accesses from EL1 to raise an undefined instruction exception. Because pKVM injects the UNDEF back into the host and the host has no handler for it during early per-CPU init, the CPU panics with Attempted to kill the idle task.

The bug only manifests on the pKVM CPU hotplug path. Plain nVHE configures the host HCR at CPUHP_AP_KVM_ONLINE, after __cpuinfo_store_cpu() runs. Under pKVM, the CPU_ON relay sets the host HCR before the CPU enters EL1, so the trap is armed when the register read executes.

Root Cause

The conditional guarding the GMID_EL1 read used the unsanitized ID_AA64PFR1_EL1 value. It did not consult the CPU's own value after applying the command-line override, and it did not check CONFIG_ARM64_MTE, which no ID register reflects. The boot CPU also stores its registers before init_cpu_features() strips unsafe overrides, so any check must clamp against the hardware value at that point.

Attack Vector

Exploitation requires the ability to trigger CPU offline and online events on a pKVM host running a kernel with MTE disabled. The vulnerability does not provide code execution or privilege escalation. The resulting panic denies service to the host and all guests it manages. See the kernel commit 5445d64 and kernel commit d2d22ff for the fix.

Detection Methods for CVE-2026-89981

Indicators of Compromise

Kernel log entries containing Internal error: Oops - Undefined instruction with pc : __cpuinfo_store_cpu.
Panic strings reading Kernel panic - not syncing: Attempted to kill the idle task following a CPU hotplug event.
Unexpected host reboots on arm64 pKVM systems shortly after echo 1 > /sys/devices/system/cpu/cpuN/online.

Detection Strategies

Inventory arm64 hosts running pKVM and confirm whether their kernels are compiled with CONFIG_ARM64_MTE=n or booted with arm64.nomte.
Correlate kernel crash dumps and kdump output with CPU hotplug operations recorded in systemd or orchestration logs.
Monitor virtualization hosts for unexplained guest downtime tied to host panics rather than guest faults.

Monitoring Recommendations

Forward dmesg, journalctl -k, and kdump artifacts from arm64 hypervisor hosts to a centralized log store for pattern matching on the panic signature.
Alert on any CPU hotplug event on pKVM hosts until patched kernels are deployed.
Track kernel package versions across the fleet to identify hosts still running vulnerable builds.

How to Mitigate CVE-2026-89981

Immediate Actions Required

Apply the upstream fix from kernel commit 5445d64 and kernel commit d2d22ff or install a distribution kernel that includes them.
Suspend CPU hotplug operations on affected pKVM hosts until the patched kernel is deployed.
Identify arm64 pKVM hosts running with MTE disabled and prioritize them for kernel updates.

Patch Information

The fix gates the GMID_EL1 read on the CPU's own ID_AA64PFR1_EL1 value after the command-line override is applied and on CONFIG_ARM64_MTE. It also clamps the boot CPU's stored register values against the hardware value so that unsafe overrides stripped later by init_cpu_features() cannot re-enable the faulty read. The patches are available in the stable tree at kernel commit 5445d64 and kernel commit d2d22ff.

Workarounds

Keep MTE enabled in the kernel configuration and avoid the arm64.nomte command-line parameter where hardware supports MTE.
Disable dynamic CPU offline/online operations on pKVM hosts until the patched kernel is installed.
On hosts that must run with MTE disabled, consider using plain nVHE instead of pKVM, since the crash path is specific to the pKVM CPU_ON relay sequence.