CVE-2026-89915

A flaw was found in the Kernel-based Virtual Machine (KVM) for ARM64 architectures. The VM-wide VNCR mapping counter, a mechanism designed to optimize Translation Lookaside Buffer (TLB) invalidations, contained several issues. These flaws could lead to situations where TLB entries are not correctly invalidated, potentially causing a guest virtual machine to operate with outdated memory translations. This could result in data integrity issues within the guest.

KVM arm64 nested virtualization can miss VNCR related TLB invalidations because a VM wide VNCR mapping counter may say that no L0 fixmap mapping is active even though the VNCR pseudo TLB still needs invalidation. An L1 guest that changes or invalidates its own VNCR backing state can leave stale translations visible to L0, causing incorrect reads or writes of guest controlled state and possible VM or host side instability. For the CVSS the PR:L is used because an attacker generally needs local ability to run or control a KVM VM with nested virtualization enabled, but does not need full host administrator privileges if /dev/kvm access is delegated. The issue is not network reachable and is triggered through KVM virtualization control paths rather than packet traffic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.