KVM arm64: missing VA sign extension in range-based TLB invalidation decoding

Impact

When decode_range_tlbi() was reused for stage-1 TLB invalidations, the required sign extension of the virtual address was left out, so the address range KVM computes for a range-based TLBI does not match what the guest asked to invalidate. Entries that should be flushed can be left in place, letting a nested guest continue to use translations it believes are gone - and the fix note warns that the same helper must avoid overflowing PA bits when used for stage-2. This is a separate defect from the VNCR level-sizing bug (CVE-2026-89775) in the same release, with its own commits, though both are in arm64 nested-virt TLBI handling and both are fixed by the same kernel update. Exposure is limited to arm64 KVM hosts running nested virtualization.

Who can reach it

A guest on an arm64 KVM host with nested virtualization enabled, issuing range-based TLB invalidations. No host credentials required.

What to do

Install the patched kernel containing the three listed commits and reboot affected arm64 KVM hosts with guests drained or migrated. Leaving nested virtualization disabled on arm64 avoids the affected path. No fixed distribution version is given in the record.

References

Related entries

• Linux kernel KVM/arm64: VM-wide VNCR mapping counter lets TLB invalidations be missed under nested virtCVE-2026-89915 · Linux kernel KVM/arm64 (nested virtualization VNCR TLB invalidation)Critical
• Linux kernel KVM/arm64: VNCR invalidation races nested page fault and installs a stale TLB entryCVE-2026-89916 · Linux kernel KVM/arm64 (VNCR fault vs. invalidation race, mmu_invalidate_seq)Critical
• Linux kernel KVM/arm64: address rollover at the end of VA space makes TLB invalidation by VA silently failCVE-2026-89918 · Linux kernel KVM/arm64 (TLBI range comparison, end of TTBR1 VA space)Critical
• Linux kernel KVM nVMX: queued TLB flushes skipped when a nested VM-Enter fails, leaving stale VPID mappingsCVE-2026-89930 · Linux kernel KVM nVMX (TLB flush on failed nested VM-Enter)Critical
• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical
• Go x/crypto ssh/agent: destination restrictions silently dropped when adding keys to a remote agentCVE-2026-39832 · golang.org/x/crypto/ssh/agent (constraint extension serialization)Critical