Linux Kernel CVE-2026-89911

Requires the ability to run and control a guest VM (vCPU execution) on a Linux arm64 host using KVM hardware virtualization; the guest must issue TLB Invalidation by Range operations with an attacker-chosen virtual address to force the uncapped range addition to overflow. Limiting factors: exploitation is LOCAL to the host (attacker must already have guest execution, i.e. PR:L via a VM), it is confined to the arm64 architecture with KVM enabled, and it does not apply to hosts not running untrusted guests. Vulnerable kernels are approximately 6.16 through the fixes in 6.18.51 / 7.2.5 / 7.3-rc1.

Vendor CVSS 7.9 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H) describes a local, low-complexity, low-privilege guest-to-host issue with a scope change and availability-dominant impact - consistent with the description: a KVM/arm64 guest issues TLB Invalidation by Range operations with an arbitrary VA that the hypervisor naively adds to a base, producing an overflow. This is a legitimate priority in arm64 virtualization hosting: the guest→host boundary crossing (S:C) is real and the overflow is deterministic and guest-controllable (AC:L), so a malicious or buggy tenant can reliably trigger it. However, real-world risk is bounded by three signals that are ALL absent: no EPSS score is provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced - so there is no evidence of exploitation, only theoretical guest-side triggerability. The C:L/I:L rating likely overstates confidentiality/integrity impact: over-invalidating TLB entries is fundamentally a correctness/availability problem (host or co-tenant DoS/misbehavior), not information disclosure, so my independent read is C:N/I:L/A:H (~7.5). Net: a genuine, patch-now item for arm64 KVM hosts running untrusted guests, but not a widespread-exploitation emergency.

A malicious or compromised guest VM on an arm64 KVM host executes TLBI Range instructions encoding a very large range anchored at a crafted virtual address. The hypervisor adds the guest-supplied range to the base VA without capping it to the architectural VA-range limit, causing an overflow that leads to incorrect/excessive TLB invalidation on the host - degrading or destabilizing the host or co-located guests. No public exploit code is identified at time of analysis.