CVE-2026-89917

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping

While VNCR TLB invalidation always occurs under the MMU lock,

vcpu_put() doesn't, while it unmaps the VNCR page.

The problem is that the invalidation evaluates vncr_tlb::cpu to

decide whether an unmapping needs to take place (cpu != -1) before

performing it. On the other hand, this_cpu_reset_vncr_fixmap()

unconditionally unmaps if L1_VNCR_MAPPED is set.

These two obviously can race, with a TOCTOU pattern on the TLBI

path, and a BUG_ON() on the vcpu_put() path. And the two can end-up

calling vncr_fixmap(-1), with extra lethal effects.

Move the reset of vncr_tlb::cpu to -1 to a common function, and make

this update atomic so that only a single thread can reset the field

and perform the corresponding unmap. The vcpu_put() still need to

unconditionally unmap the current VNCR to close another ugly race.

Finally, the assignment of vncr_tlb::cp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References