CVE-2026-89916

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) for arm64 architectures. This vulnerability involves a race condition during Translation Lookaside Buffer (TLB) invalidation. Specifically, one virtual CPU (vcpu) could attempt to insert a TLB entry for a page that another vcpu has concurrently marked as invalid. This could lead to incorrect memory translations, potentially causing system instability or unexpected behavior within the virtualized environment.

KVM arm64 nested virtualization can install a stale VNCR TLB entry because a VNCR VA invalidation did not participate in the mmu_invalidate_seq retry protocol while another vCPU was translating the same VNCR page. A malicious or buggy guest with control over nested S1 page tables and TLBI operations could win this race and make KVM cache a translation for a page that was invalidated during a BBM sequence. For the CVSS the PR:L is used because reliable triggering requires code execution or control inside a guest vCPU context rather than unauthenticated network access, but it does not require full host administrator privileges. The issue is not network reachable from outside the host and is triggered through the KVM guest execution path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.