CVE-2026-89911
Description
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component. A guest operating system can trigger an integer overflow in the TLB (Translation Lookaside Buffer) Invalidation by Range mechanism. This occurs when the hypervisor incorrectly handles a large range value provided by the guest, potentially leading to an overflow. This vulnerability could allow a malicious guest to impact the stability or availability of the host system.
Statement
A KVM/arm64 nested virtualization bug can allow a guest controlled TLBI Range operation to produce an overflowing address range when the decoded range is added to the base VA. This may cause incorrect TLB invalidation, including stale translations or invalidation of the wrong address interval, which is security sensitive in a hypervisor MMU path. For the CVSS the PR:L is used because the attacker typically needs control of a guest or guest privileged code path, but does not need host administrator privileges. The issue is not directly network reachable and requires access to a VM environment with the affected nested virtualization feature. Impact is at least denial of service or VM isolation correctness failure, and in the paranoid interpretation may allow limited confidentiality or integrity impact through stale translation behavior.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.3 | N/A | 7.9 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | Low | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
