Linux kernel KVM/arm64: VM-wide VNCR mapping counter lets TLB invalidations be missed under nested virt

Impact

KVM on arm64 used a VM-wide counter of VNCR page mappings to decide whether a TLB invalidation was needed for a nested guest. The counter tracks an opportunistic fixmap mapping rather than the TLB itself, so invalidations could be skipped and a nested guest could keep using stale translations; an L1 vCPU invalidating its own TLB would not reach the VNCR pseudo-TLB at all. The fix removes the counter entirely, since it was only a performance optimisation. This only matters on arm64 hosts running nested virtualization (FEAT_NV2), for example Grace-class GPU nodes that hand VMs to tenants which themselves run hypervisors; a host with no nested guests is not affected.

Who can reach it

Local, from inside a nested guest on an arm64 KVM host with nested virtualization enabled. No host credentials needed beyond running a VM; unreachable if NV is not in use.

What to do

Update to a stable kernel carrying the linked commits and reboot each affected arm64 host - guests must be migrated or stopped first, so plan a drain per node. Hosts that do not enable nested virtualization can defer to the next scheduled kernel window. The record names no fixed release numbers, only the stable commits.

References

Related entries

• Linux kernel KVM/arm64: VNCR invalidation races nested page fault and installs a stale TLB entryCVE-2026-89916 · Linux kernel KVM/arm64 (VNCR fault vs. invalidation race, mmu_invalidate_seq)Critical
• Linux kernel KVM/arm64: address rollover at the end of VA space makes TLB invalidation by VA silently failCVE-2026-89918 · Linux kernel KVM/arm64 (TLBI range comparison, end of TTBR1 VA space)Critical
• Linux kernel KVM nVMX: queued TLB flushes skipped when a nested VM-Enter fails, leaving stale VPID mappingsCVE-2026-89930 · Linux kernel KVM nVMX (TLB flush on failed nested VM-Enter)Critical
• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical
• Go x/crypto ssh/agent: destination restrictions silently dropped when adding keys to a remote agentCVE-2026-39832 · golang.org/x/crypto/ssh/agent (constraint extension serialization)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical