CVE-2026-89775

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for arm64 systems. This issue arises when the system's Memory Management Unit (MMU) is inactive, causing an internal calculation for memory translation buffers (TLB) to misinterpret a negative value. This leads to an incorrect determination of the memory region size for invalidation, resulting in an incomplete cleanup of these buffers. Such an incomplete invalidation could lead to unexpected memory behavior within the virtualized environment.

Red Hat has rated this vulnerability as having an Important severity impact because a local user or nested guest with access to the hypervisor can trigger incomplete translation buffer flushes, potentially leading to host privilege escalation or guest escape. The issue is restricted exclusively to ARM64 deployments where nested virtualization is enabled on the host. Earlier enterprise releases, including Red Hat Enterprise Linux 8 and 9, do not include the vulnerable nested virtualization implementation and are therefore unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.