CVE-2026-89914 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Sign-extend VA for range-based TLBI invalidation
When the decode_range_tlbi() helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it.
As a result, special care must be taken to not overflow PA bits when this is used for S2 invalidation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified in the KVM arm64 subsystem involves a critical arithmetic error within the translation lookaside buffer management logic. Specifically, the decode_range_tlbi helper function was repurposed to handle Stage 1 Translation Lookaside Buffer Invalidation operations. During this transition, the necessary sign-extension of the virtual address range parameters was inadvertently omitted. This oversight means that when negative values or large unsigned integers are processed as signed quantities without proper extension, the resulting calculations for memory addresses can become corrupted. The core technical flaw lies in the failure to correctly interpret the bit-width and sign of the input arguments before performing arithmetic operations on them, leading to potential integer overflow scenarios where the calculated physical address bits exceed their valid range.
This defect directly impacts the integrity of memory isolation mechanisms provided by the hypervisor. In virtualized environments using ARM64 architecture, accurate TLB invalidation is essential for maintaining security boundaries between guest operating systems and the host kernel. If the sign extension is missing, the system may compute an incorrect physical address or range when attempting to invalidate cache entries. This can result in either a failure to clear stale translations, leaving potentially sensitive data accessible through outdated mappings, or more critically, triggering invalid memory accesses that could crash the virtual machine instance or cause undefined behavior within the hypervisor code path. The operational impact includes potential denial of service for affected guest instances and possible exposure of host memory if the overflow leads to out-of-bounds writes during subsequent operations dependent on these corrupted addresses.
From a vulnerability classification perspective, this issue aligns with CWE-190 Integer Overflow or Wraparound, as the arithmetic operation fails due to improper handling of signed versus unsigned data types. It also relates to CWE-682 Incorrect Calculation, where the logic for determining memory ranges is flawed due to missing bit manipulation steps. In terms of attack vectors and defensive mapping, this flaw could be leveraged in conjunction with other vulnerabilities to escalate privileges from a guest environment to the host level by manipulating TLB state inconsistencies. It falls under ATT&CK techniques related to Defense Evasion via Virtualization or Hypervisor exploitation, specifically involving memory management sub-techniques where an attacker might attempt to confuse the hypervisor's address translation logic.
Mitigation for this vulnerability requires applying the upstream kernel patch that reintroduces the sign-extension logic into the decode_range_tlbi function. System administrators should ensure their Linux kernels are updated to versions containing this fix, particularly those running KVM with ARM64 support. For developers and security engineers reviewing similar code paths, it is crucial to enforce strict type checking and explicit casting when dealing with hardware register fields or architectural address bits that have specific sign requirements. Regular static analysis focused on integer arithmetic safety in low-level system components can help detect such omissions before they reach production environments. Additionally, fuzz testing of hypervisor interfaces using tools designed to trigger edge cases in memory range calculations is recommended to uncover similar logical errors in related subsystems.