CVE-2026-89911

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component. A guest operating system can trigger an integer overflow in the TLB (Translation Lookaside Buffer) Invalidation by Range mechanism. This occurs when the hypervisor incorrectly handles a large range value provided by the guest, potentially leading to an overflow. This vulnerability could allow a malicious guest to impact the stability or availability of the host system.

A KVM/arm64 nested virtualization bug can allow a guest controlled TLBI Range operation to produce an overflowing address range when the decoded range is added to the base VA. This may cause incorrect TLB invalidation, including stale translations or invalidation of the wrong address interval, which is security sensitive in a hypervisor MMU path. For the CVSS the PR:L is used because the attacker typically needs control of a guest or guest privileged code path, but does not need host administrator privileges. The issue is not directly network reachable and requires access to a VM environment with the affected nested virtualization feature. Impact is at least denial of service or VM isolation correctness failure, and in the paranoid interpretation may allow limited confidentiality or integrity impact through stale translation behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.