KVM arm64: negative stage-1 walk level mis-sizes VNCR TLB invalidation to zero

Impact

Sizing a TLB invalidation for a stage-1 VNCR mapping combines the granule size with the walk level, but when the guest's stage-1 MMU is off the level is the sentinel -127, which pgshift_level_to_ttl() casts to u8 and reads only the bottom two bits - yielding an invalidation size of zero. Stale VNCR TLB entries then survive an invalidation the guest believes it performed, so a nested guest can keep using translations that should have been torn down. CVSS is 9.3 with a changed scope, i.e. the kernel CNA treats this as reachable across the guest/host boundary on arm64 hosts running nested virtualization. This only affects arm64 hosts with NV enabled; x86 fleets and arm64 hosts not running nested guests are not exposed.

Who can reach it

A guest on an arm64 KVM host with nested virtualization enabled, running with its stage-1 MMU disabled and issuing TLB invalidations. No host credentials required.

What to do

Apply the stable-kernel update with the three listed commits and reboot affected arm64 KVM hosts, draining or migrating guests first. As an interim mitigation, do not enable nested virtualization on arm64 hosts - the affected code is only reached on the NV path. The record names no fixed distribution version.

References

Related entries

• KVM arm64: missing VA sign extension in range-based TLB invalidation decodingCVE-2026-89914 · Linux kernel KVM arm64 nested virtualization (decode_range_tlbi VA sign extension)Critical
• Linux kernel KVM/arm64: VM-wide VNCR mapping counter lets TLB invalidations be missed under nested virtCVE-2026-89915 · Linux kernel KVM/arm64 (nested virtualization VNCR TLB invalidation)Critical
• Linux kernel KVM/arm64: VNCR invalidation races nested page fault and installs a stale TLB entryCVE-2026-89916 · Linux kernel KVM/arm64 (VNCR fault vs. invalidation race, mmu_invalidate_seq)Critical
• Linux kernel KVM/arm64: address rollover at the end of VA space makes TLB invalidation by VA silently failCVE-2026-89918 · Linux kernel KVM/arm64 (TLBI range comparison, end of TTBR1 VA space)Critical
• Linux kernel KVM nVMX: queued TLB flushes skipped when a nested VM-Enter fails, leaving stale VPID mappingsCVE-2026-89930 · Linux kernel KVM nVMX (TLB flush on failed nested VM-Enter)Critical
• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical