CVE-2026-89908

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY

kvm_arch_prepare_memory_region() computes new->arch.flags, i.e. whether

a memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE,

only for KVM_MR_CREATE and KVM_MR_MOVE, and returns early for every

other change. But the generic code allocates a zeroed memslot for every

change and never copies old->arch, so after a KVM_MR_FLAGS_ONLY update,

e.g. toggling KVM_MEM_LOG_DIRTY_PAGES for live migration, the active

memslot has arch.flags == 0.

With both flags clear, fault_supports_huge_mapping() falls through to

the alignment check on the HVA range alone, which no longer verifies

that the GPA and HVA have the same offset within a PMD. A memslot that

was marked KVM_MEM_HUGEPAGE_INCAPABLE because of a GPA/HVA offset

mismatch can then be mapped with PMD entries on read faults, and since

kvm_map_page() aligns the gfn and the pfn independently, the guest

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References