Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-16T00:00:00 kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-190

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from the combination of the base granule size and the mapping level. However, this implies that the S1 MMU is *on*. When the MMU is off, we indicate this with the level being set to a "creative" value of -127 (S1_MMU_DISABLED). This ends-up being misinterpreted by pgshift_level_to_ttl() as it doesn't handle negative levels at all (the level is immediately cast to a u8 and only the bottom two bits considered), leading to an invalidation size of 0. Not helpful. Tidy-up pgshift_level_to_ttl() to handle these negative levels, and ttl_to_size() to always return SZ_1G when no valid TTL is present. This allows the removal of open-coded checks for similar situations. Note that the check for a negative value not explicitely checking for S1_MMU_DISABLED is deliberate, so that actual negative levels introduced with LVA2 and D128 can take the same path if we ever support them.

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for arm64 systems. This issue arises when the system's Memory Management Unit (MMU) is inactive, causing an internal calculation for memory translation buffers (TLB) to misinterpret a negative value. This leads to an incorrect determination of the memory region size for invalidation, resulting in an incomplete cleanup of these buffers. Such an incomplete invalidation could lead to unexpected memory behavior within the virtualized environment.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 10 Affected kernel-rt Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-89775 https://nvd.nist.gov/vuln/detail/CVE-2026-89775 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89775.mbox