CVE-2026-89918

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64 architectures. The code responsible for invalidating Translation Lookaside Buffer (TLB) entries, which are used to optimize virtual address translations, does not correctly handle specific end-of-address-space conditions. This oversight can lead to a failure in invalidating TLB entries, potentially resulting in the use of outdated memory mappings.

KVM arm64 nested virtualization can miss a VA based TLBI invalidation at the end of the TTBR1 VA space because the range comparison used base plus size and did not handle address rollover. A guest controlled TLBI range that reaches the end of the VA space may therefore leave a stale VNCR TLB entry active and later KVM code may use an obsolete translation. For the CVSS the PR:L value is used because reliable triggering requires local KVM access or control of a guest context rather than a remote packet only interface. The issue is not directly network reachable and depends on arm64 nested virtualization support and the affected VNCR TLBI path. Impact is at least denial of service or guest memory integrity impact from stale translation use.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.