CVE-2026-89917

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64 architectures. A race condition exists between the Virtual Nested Cache Register (VNCR) Translation Lookaside Buffer (TLB) invalidation and the vcpu_put() function's unmapping of the VNCR page. This time-of-check to time-of-use (TOCTOU) vulnerability can lead to a system crash, resulting in a denial of service.

A race in KVM arm64 nested virtualization can occur between VNCR TLB invalidation and vcpu_put unmapping of the VNCR fixmap. The race can make both paths observe stale mapping state and can lead to a BUG_ON or a call to vncr_fixmap with cpu -1, causing a host kernel crash or unstable fixmap state. For the CVSS the PR:L is used because a local user or guest workload with access to KVM is needed to create and run the affected vCPU state. The issue is not network reachable and requires an affected arm64 KVM nested virtualization configuration. Impact is at least denial of service via host kernel crash and in the paranoid case may include limited confidentiality or integrity impact because the bug affects host fixmap unmapping state across racing CPUs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.