CVE-2026-89914

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component for ARM64 architectures. An omission in the decode_range_tlbi() helper, responsible for managing the Translation Lookaside Buffer (TLB), failed to correctly extend virtual addresses (VA) during certain invalidation operations. This could lead to an overflow of physical address (PA) bits, potentially causing incorrect memory handling. The consequence of this flaw could be system instability or, in certain scenarios, information disclosure or denial of service.

KVM/arm64 range based TLBI decoding could use a non sign extended virtual address after the helper was reused for Stage 1 invalidations. This may cause KVM to invalidate the wrong address range and leave stale TLB translations active for a guest or nested guest. For the CVSS the PR:L is used because the realistic attacker needs local ability to run or control a guest or nested guest that can issue the relevant TLBI operation, but full host administrator privileges are not required. The issue is not directly network reachable and would normally be exercised through virtualization control or guest execution rather than packet traffic. Impact is at least a guest correctness or availability problem.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.