Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89916— KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： 在 Linux 内核中，以下漏洞已得到解决： KVM: arm64：让 VNCR 失效操作参与 MMU 失效重试机制 当一个 vCPU 执行 VNCR TLB 失效时，另一个 vCPU 可能正在对同一页进行缺页异常处理。若未能正确处理这种情况，可能会导致以下场景： vCPU A 遍历页表（PTs）以解析 VNCR 地址 在 vCPU A 获取 MMU 锁以插入 TLB 之前，vCPU B 将 S1 页表更新为一个无效条目，并针对该虚拟地址（VA）发出 TLBI S1E2 指令 结果 v

CVSS 9.3 · Critical EPSS 0.18% · P8

Possible ATT&CK Techniques 1 AI

T1601 · Modify System Image

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929< d8580e7aa189b0c6c5bb4d94b8352728a7c35bbd affected
4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929< 11ee3faab4f1755d126bead9f882e75a7a677860 affected
4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929< 2b7324f3a0c1072b9d578b8d42f199506753f26e affected
6.16 affected
< 6.16 unaffected
6.18.51≤ 6.18.* unaffected
7.2.5≤ 7.2.* unaffected
7.3-rc1≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89916

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the following scenario: - vcpu A walks the PTs to translate VNCR - before vcpu A is able to grab the MMU lock to insert the TLB, vcpu B updates the S1 PTs with an invalid entry, and issues a TLBI S1E2 for this VA - vcpu A inserts the TLB for something that is now invalid This isn't a new problem, and we manage S2 by having the MMU notifier to bump up mmu_invalidate_seq on invalidation so that the fault can be replayed. We can perform something similar here, and extend invalidate_vncr_va() to update the same counter, clearly indicating that the context has changed under our feet. This is safe as the invalidation always happen while holding the MMU lock for write, and that we sample the sequence number before walking S1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 ~ d8580e7aa189b0c6c5bb4d94b8352728a7c35bbd -
Linux Linux 6.16 -

II. Public POCs for CVE-2026-89916

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89916

请登录查看更多情报信息。

Other References for CVE-2026-89916 (3)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
CVE-2026-89918 9.3 CRITICAL KVM: arm64: Correctly handle end of VA space TLBI invalidation
CVE-2026-89914 9.3 CRITICAL KVM: arm64: Sign-extend VA for range-based TLBI invalidation
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89916

No comments yet

Leave a comment