Linux Kernel arm64 __cpuinfo_store_cpu input validation

Summaryinfo

A vulnerability categorized as problematic has been discovered in Linux Kernel. Impacted is the function __cpuinfo_store_cpu of the component arm64. Executing a manipulation can lead to input validation. The identification of this vulnerability is CVE-2026-89981. The attack can only be executed locally. There is no exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel (affected version unknown). This vulnerability affects the function __cpuinfo_store_cpu of the component arm64. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMID_EL1 when MTE is disabled __cpuinfo_store_cpu() gates the GMID_EL1 read on the raw ID_AA64PFR1_EL1, so it reads the register even when the kernel has disabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5 in that case, and pKVM injects an UNDEF the host cannot handle: Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP pc : __cpuinfo_store_cpu+0xf4/0x264 Kernel panic - not syncing: Attempted to kill the idle task! Only pKVM reaches it, and only after a CPU is offlined and brought back online: its CPU_ON relay sets the host HCR before the CPU enters EL1, while plain nVHE sets it at CPUHP_AP_KVM_ONLINE. Gate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line override applied, and on CONFIG_ARM64_MTE, which no register reflects. The boot CPU stores its registers before init_cpu_features() strips an unsafe override, so clamp against the hardware value here too.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-89981 since 09/11/2026. The exploitation appears to be easy. The attack needs to be approached locally. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available.

Applying the patch d2d22ff377cd43f2e9660426ff22e3cd4c534637/5445d64199626974269fcdf347769ad44b0bb53b is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion