CVE-2026-89908

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89908", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.774Z", "datePublished": "2026-09-16T10:32:06.599Z", "dateUpdated": "2026-10-19T08:54:40.893Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:54:40.893Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY\n\nkvm_arch_prepare_memory_region() computes new->arch.flags, i.e. whether\na memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE,\nonly for KVM_MR_CREATE and KVM_MR_MOVE, and returns early for every\nother change. But the generic code allocates a zeroed memslot for every\nchange and never copies old->arch, so after a KVM_MR_FLAGS_ONLY update,\ne.g. toggling KVM_MEM_LOG_DIRTY_PAGES for live migration, the active\nmemslot has arch.flags == 0.\n\nWith both flags clear, fault_supports_huge_mapping() falls through to\nthe alignment check on the HVA range alone, which no longer verifies\nthat the GPA and HVA have the same offset within a PMD. A memslot that\nwas marked KVM_MEM_HUGEPAGE_INCAPABLE because of a GPA/HVA offset\nmismatch can then be mapped with PMD entries on read faults, and since\nkvm_map_page() aligns the gfn and the pfn independently, the guest ends\nup accessing the wrong host pages, exactly the \"d -> f, e -> g\" case\ndescribed in the comment above the check.\n\nCarry the arch flags over from the old memslot for KVM_MR_FLAGS_ONLY,\nas the GPA, HVA and size are guaranteed to be unchanged for that case."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached from a LoongArch KVM guest page fault on the host KVM_RUN path (kvm_arch_vcpu_ioctl_run -> kvm_handle_exit -> kvm_handle_fault -> kvm_handle_mm_fault -> kvm_map_page) after KVM_SET_USER_MEMORY_REGION FLAGS_ONLY; there is no network or physical path.\nAC:L - After FLAGS_ONLY zeros memslot arch.flags, a guest load to an interior GPA of a GPA/HVA-offset-mismatched slot with host THP backing deterministically installs a PMD because kvm_map_page aligns gfn and pfn independently; the VMM chooses the memslot and dirty-log toggle, and THP is a common default, not a rare config or uncontrolled race.\nPR:L - A tenant guest or a host kvm-group user running QEMU is sufficient: /dev/kvm and kvm_vm_ioctl() have no capable() check, and the fault path has none either. Init-namespace root is not required, so this is Low rather than High.\nUI:N - The attacker guest issues the faulting load or store itself during KVM_RUN; no separate victim action such as mounting a filesystem, opening a crafted file, or confirming a prompt is required.\nS:C - kvm_map_page installs stage-2 PMD entries that bind guest GPAs to the wrong host PFNs, breaking the hypervisor GPA-to-HVA contract and crossing the KVM guest-to-host isolation boundary, which CNA guidance rates Changed for KVM guest-to-host escape.\nC:H - On read faults, fault_supports_huge_mapping() allows a PMD that maps the guest onto the wrong host pages (the commit's d->f, e->g case), giving the guest an unauthorized read of the host physical pages backing that 2MB block.\nI:H - After dirty logging is toggled off (another FLAGS_ONLY that also leaves arch.flags at 0), write faults install writable huge mappings to those same wrong host PFNs, so the guest can modify host pages the memslot did not bind to that GPA.\nA:H - Aliased stage-2 PMDs scramble guest RAM and, during live migration, produce a corrupted destination image that can crash the VM; incorrect huge PFNs can also oops the host if the aligned range is not valid RAM, denying service to the hypervisor and co-located VMs."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/loongarch/kvm/mmu.c"], "versions": [{"version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c", "lessThan": "7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8", "status": "affected", "versionType": "git"}, {"version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c", "lessThan": "4e4dbc341b1581dc512b85d98b768373b0398366", "status": "affected", "versionType": "git"}, {"version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c", "lessThan": "bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba", "status": "affected", "versionType": "git"}, {"version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c", "lessThan": "27a9bfee3bbcb3cabb77797354f07e0e44e49831", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/loongarch/kvm/mmu.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8"}, {"url": "https://git.kernel.org/stable/c/4e4dbc341b1581dc512b85d98b768373b0398366"}, {"url": "https://git.kernel.org/stable/c/bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba"}, {"url": "https://git.kernel.org/stable/c/27a9bfee3bbcb3cabb77797354f07e0e44e49831"}], "title": "LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/loongarch/kvm/mmu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8", "status": "affected", "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c", "versionType": "git"}, {"lessThan": "4e4dbc341b1581dc512b85d98b768373b0398366", "status": "affected", "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c", "versionType": "git"}, {"lessThan": "bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba", "status": "affected", "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c", "versionType": "git"}, {"lessThan": "27a9bfee3bbcb3cabb77797354f07e0e44e49831", "status": "affected", "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/loongarch/kvm/mmu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY\n\nkvm_arch_prepare_memory_region() computes new->arch.flags, i.e. whether\na memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE,\nonly for KVM_MR_CREATE and KVM_MR_MOVE, and returns early for every\nother change. But the generic code allocates a zeroed memslot for every\nchange and never copies old->arch, so after a KVM_MR_FLAGS_ONLY update,\ne.g. toggling KVM_MEM_LOG_DIRTY_PAGES for live migration, the active\nmemslot has arch.flags == 0.\n\nWith both flags clear, fault_supports_huge_mapping() falls through to\nthe alignment check on the HVA range alone, which no longer verifies\nthat the GPA and HVA have the same offset within a PMD. A memslot that\nwas marked KVM_MEM_HUGEPAGE_INCAPABLE because of a GPA/HVA offset\nmismatch can then be mapped with PMD entries on read faults, and since\nkvm_map_page() aligns the gfn and the pfn independently, the guest ends\nup accessing the wrong host pages, exactly the \"d -> f, e -> g\" case\ndescribed in the comment above the check.\n\nCarry the arch flags over from the old memslot for KVM_MR_FLAGS_ONLY,\nas the GPA, HVA and size are guaranteed to be unchanged for that case."}], "id": "CVE-2026-89908", "lastModified": "2026-10-19T09:18:36.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:16:59.807", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/27a9bfee3bbcb3cabb77797354f07e0e44e49831"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4e4dbc341b1581dc512b85d98b768373b0398366"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c,7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c,4e4dbc341b1581dc512b85d98b768373b0398366)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c,bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c,27a9bfee3bbcb3cabb77797354f07e0e44e49831)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.51,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.5,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-16T21:00:07.239653+00:00", "updated": "2026-09-18T03:45:01.806680+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-269", "CWE-20"]}