Linux Kernel KVM CVE-2026-89908

Requires: (1) a LoongArch host running KVM with a guest VM; (2) local access to the KVM VM-fd / VMM process (PR:L); (3) a memslot that was marked KVM_MEM_HUGEPAGE_INCAPABLE due to a GPA/HVA offset mismatch within a PMD; (4) a KVM_MR_FLAGS_ONLY memslot update - most naturally toggling KVM_MEM_LOG_DIRTY_PAGES during live migration - which zeroes the arch flags; and (5) subsequent guest read faults that then get mapped with PMD (huge) entries. These specific preconditions (alignment mismatch plus a flags-only update during migration) are the primary LIMITS on exploitation and make the vendor's AC:L optimistic; the bug does not manifest against a static, non-migrating guest with aligned memslots. Affects only the LoongArch architecture.

The vendor scores this 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and unlike most of the sibling LoongArch cluster (which are DoS-dominant), the impact here is genuinely high: after a KVM_MR_FLAGS_ONLY memslot update (e.g. enabling KVM_MEM_LOG_DIRTY_PAGES for live migration), the arch flags are lost, a hugepage-INCAPABLE slot can be mapped with PMD entries, and the guest ends up reading/writing the WRONG host pages - a cross-boundary confidentiality AND integrity failure, not just a crash. That justifies C:H/I:H and the S:C scope change (guest→host). However, AC:L is questionable: the bug only manifests when a memslot was marked HUGEPAGE_INCAPABLE due to a specific GPA/HVA PMD-offset mismatch AND dirty-logging is toggled AND transparent/huge mappings are in play - a narrow, largely operationally-induced condition rather than a trivially reproducible one, so AC:H is more honest. No EPSS, no KEV, and no public POC are present in the input - exploitation status is 'no public exploit identified at time of analysis'. Net: a legitimately serious guest→host memory-safety bug, but real-world priority is bounded by the niche LoongArch KVM footprint and the specific migration/alignment preconditions. No SSVC data was provided.

During a live migration of a LoongArch KVM guest, the VMM enables dirty-page logging (KVM_MR_FLAGS_ONLY) on a memslot whose GPA/HVA offsets are misaligned within a PMD. The lost arch flags cause the host to map that slot with hugepages on subsequent guest read faults, and because gfn and pfn are aligned independently, the guest silently accesses host physical pages outside its intended mapping - enabling disclosure or corruption of host/other-guest memory. No public exploit code is identified at time of analysis.