CVE-2026-89775

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

UBUNTU-CVE-2026-89775

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

EUVD-2026-80296

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

CVE-2026-89775 KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

CVE-2026-89775 KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

CVE-2026-89775

CVE-2026-89775 affects the Linux kernel in the KVM arm64 subsystem. When the S1 MMU is disabled, the page-table walk level is set to −127 (S1_MMU_DISABLED), but pgshift_level_to_ttl() casts it to an unsigned 8-bit value, yielding an invalidation size of 0 during VNCR TLB evaluation. This can leav...

CVE-2026-89775

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

RLSA-2026:67469 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast addre...

PT-2026-93556

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM arm64 implementation regarding the global VNCR mapping counter. This counter is used to determine if an L1 provided VNCR page is mapped in L0 during TLB...

PT-2026-93562

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the KVM s390 component, the kvm inject pfault token function fails to fully initialize the kvm s390 irq structure on the stack. While .type and .u.ext.ext params2 are set, the ext...

CVE-2026-89912: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

CVE-2026-89916: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

CVE-2026-89929: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1 assigned VPID, after doing some validations on the operands. However...

CVE-2026-89914: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...

CVE-2026-89957: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...

PT-2026-93570

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM nested VM nVM implementation where the INVVPID instruction may be emulated on an incorrect physical CPU. When emulating INVVPID, KVM uses vpid02 on the current...

PT-2026-93552

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the KVM arm64 implementation, a flaw exists in how TLB Invalidation by Range is handled. Because the range can be based on an arbitrary Virtual Address VA, a guest could potentially...

PT-2026-93548

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the LoongArch architecture, the KVM component fails to validate MSI Message Signaled Interrupts data before routing it to the EIOINTC. The function pch msi set irq passes e-msi.data...

CVE-2026-89919: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: keyop: use mmulock to read gmap-asce Every other dat consumer in this file kvms390getskeys, setskeys, getcmmabits, setcmmabits, MEMCLRCMMA, kvms390fixupprefix, kvmtestagegfn, kvmagegfn reads kvm-arch.gmap-asce inside t...

CVE-2026-89921: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for injectpfaulttoken kvminjectpfaulttoken only sets .type and .u.ext.extparams2 of the on-stack struct kvms390irq but the full ext substructure is copied into the cpu local variable on...