CVE-2026-89919

CVE-2026-89919 affects the Linux kernel's KVM s390 subsystem. The keyop function reads kvm->arch.gmap->asce without holding the mmu_lock read-side, unlike every other dat_* consumer in the same file. Because gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit(), a concurre...

CVE-2026-89920 KVM: s390: Fix memory corruption by not reinjecting CK machine checks

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

CVE-2026-89920 KVM: s390: Fix memory corruption by not reinjecting CK machine checks

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix memory corruption by not reinjecting CK machine checks Channel-subsystem damage machine checks are for the host channel subsystem. The guest channel subsystem is emulated in the userspace VMM. There is no point in...

EUVD-2026-80518

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89918 KVM: arm64: Correctly handle end of VA space TLBI invalidation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89918

CVE-2026-89918 affects the Linux kernel KVM arm64 subsystem. The root cause is a flaw in the TLB invalidation (TLBI) by virtual address range: when the TLBI instruction's range reaches the end of the TTBR1 VA space , the expression base + size wraps around to 0, causing the range comparison to fa...

CVE-2026-89918 KVM: arm64: Correctly handle end of VA space TLBI invalidation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI instruction. Each range is defined by a start an...

CVE-2026-89917 KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

EUVD-2026-80517

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

CVE-2026-89917

A race condition in the Linux kernel's KVM arm64 hypervisor exists between the VNCR TLB invalidation path (which runs under the MMU lock) and vcpu_put() 's VNCR unmapping (which does not). The TOCTOU pattern on the TLB path checks vncr_tlb::cpu before unmapping, while this_cpu_reset_vncr_fixmap()...

CVE-2026-89916

CVE-2026-89916 is a race condition in the Linux kernel's KVM arm64 subsystem where VNCR TLB invalidation did not participate in the MMU invalidation retry mechanism. When one vCPU invalidates a page via TLBI S1E2 while another vCPU is concurrently faulting in the same page, the faulting vCPU can ...

CVE-2026-89915

This vulnerability affects the Linux kernel's KVM arm64 subsystem, where a flawed VM-wide VNCR mapping counter is used to decide whether an L1-provided VNCR page is mapped in L0 during TLB invalidation. The counter can result in missed TLB invalidations , and fails when an L1 vCPU invalidates its...

CVE-2026-89915 KVM: arm64: Remove VM-wide VNCR mapping counter

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

CVE-2026-89916 KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

EUVD-2026-80515

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

EUVD-2026-80516

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

CVE-2026-89915 KVM: arm64: Remove VM-wide VNCR mapping counter

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when...

CVE-2026-89916 KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. Without correctly handling this, we can end up with the...

EUVD-2026-80514

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...

CVE-2026-89914 KVM: arm64: Sign-extend VA for range-based TLBI invalidation

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decoderangetlbi helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not...