CVE-2026-89775 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from the combination of the base granule size and the mapping level.
However, this implies that the S1 MMU is *on*. When the MMU is off, we indicate this with the level being set to a "creative" value of -127 (S1_MMU_DISABLED).
This ends-up being misinterpreted by pgshift_level_to_ttl() as it doesn't handle negative levels at all (the level is immediately cast to a u8 and only the bottom two bits considered), leading to an invalidation size of 0. Not helpful.
Tidy-up pgshift_level_to_ttl() to handle these negative levels, and ttl_to_size() to always return SZ_1G when no valid TTL is present. This allows the removal of open-coded checks for similar situations.
Note that the check for a negative value not explicitely checking for S1_MMU_DISABLED is deliberate, so that actual negative levels introduced with LVA2 and D128 can take the same path if we ever support them.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel vulnerability identified in the KVM arm64 subsystem involves a critical logic error within the translation lookaside buffer invalidation mechanism for stage one mappings, specifically affecting Virtual Non-Cacheable Register (VNCR) contexts. The core issue arises during the computation of TLB invalidation effects, where the system must determine the size of the mapping cached in the TLB to ensure proper cache coherency and memory management integrity. For stage one mappings such as VNCR, this size is derived from a combination of the base granule size and the current mapping level. However, when the stage one MMU is disabled, the kernel uses a specific sentinel value of negative 127, designated as S1_MMU_DISABLED, to indicate this state rather than using standard positive integer levels that represent valid translation table walk depths.
The technical flaw lies in how the function pgshift_level_to_ttl processes these level values. The implementation fails to account for negative inputs because it immediately casts the signed level value to an unsigned 8-bit integer type. This casting operation discards the sign bit and retains only the lower bits of the original value, leading to a misinterpretation of the intended disabled state as a valid but incorrect mapping level. Consequently, the subsequent calculation results in a TTL (Translation Table Level) that does not correspond to any meaningful memory size, ultimately causing the invalidation routine to calculate an effect size of zero bytes. This effectively means that when the MMU is off and TLB entries need to be invalidated for VNCR contexts, no actual invalidation occurs because the system believes there are no mappings or incorrectly calculates them as having zero size, leaving stale translations in place.
The operational impact of this vulnerability centers on memory management reliability within virtualized environments running on ARM64 architecture. When TLB invalidations fail to execute correctly due to a calculated size of zero, guest operating systems may retain access to physical pages that should have been unmapped or modified by the hypervisor. This can lead to data corruption, security breaches where guests access memory they no longer own, and potential system instability as stale translations cause page faults or incorrect memory accesses. The issue is particularly relevant in scenarios involving dynamic changes to VM configurations or when transitioning between states where MMU enablement toggles occur frequently, such during context switches or power management events within the virtualized environment.
To mitigate this vulnerability, the kernel developers have updated pgshift_level_to_ttl() to explicitly handle negative level values before any type casting occurs, ensuring that disabled MMU states are correctly identified and processed. Additionally, the ttl_to_size function has been modified to return a standard one-gigabyte size when no valid TTL is present, providing a safe fallback behavior rather than returning zero. These changes also allow for the removal of open-coded checks throughout the codebase that previously attempted to handle these edge cases manually, thereby reducing complexity and potential for future errors. The design intentionally avoids checking specifically for S1_MMU_DISABLED in favor of handling any negative value, which provides forward compatibility with upcoming features like Large Virtual Address 2 (LVA2) and dynamic granule sizes defined in D128, ensuring that similar edge cases will be handled consistently if new architectural extensions introduce different negative level indicators.
From a classification perspective, this vulnerability aligns with CWE-697, which refers to incorrect comparison of unsigned integers against signed values, as the root cause is the improper handling of sign bits during type conversion leading to logic errors in control flow and arithmetic operations. In terms of attack vectors and defensive posturing under the MITRE ATT&CK framework, this flaw relates to Defense Evasion techniques where an attacker might exploit stale TLB entries to maintain access to memory regions after permissions have been revoked by the host or hypervisor. It also touches upon Resource Management issues similar to CWE-754 related to improper check for unusual or exceptional conditions during resource allocation and deallocation processes within kernel subsystems.