Linux Kernel CVE-2026-89914

Requires the host to be running arm64 KVM virtualization AND the attacker to control a guest VM/vCPU capable of issuing range-based TLBI operations (this is the privilege that makes PR:L, not PR:N). The bug is triggered specifically on the range-based TLBI invalidation path where high virtual addresses expose the missing sign-extension (S1) or where PA bits can be overflowed (S2); it does not affect x86 or non-KVM hosts. Limiting factors: no network reachability (local/guest-context only), no user interaction, deterministic once a guest can run the relevant TLBI instructions, and it is inapplicable to kernels before ~6.16 or after the 6.18.51/7.2.5/7.3-rc1 fixes.

This is a Linux kernel KVM/arm64 hypervisor bug: decode_range_tlbi() was reused for stage-1 (S1) TLBI handling but omitted the VA sign-extension, so range-based TLB invalidation is computed against the wrong VA range, and stage-2 (S2) use of the same helper can overflow PA bits. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 9.3) overstates the risk on two counts. First, PR:N is almost certainly wrong: range-based TLBI is issued by a guest vCPU, which requires the attacker to already control a VM - a privilege - so PR:L is the honest choice (this matches the near-twin CVE-2026-89911, which the vendor itself scored PR:L). Second, C:H/I:H is optimistic for a mis-computed TLB invalidation range; the realistic dominant impact is availability (host TLB corruption / over- or under-invalidation → instability), with only a bounded integrity risk from stale S2 mappings and little clear confidentiality loss. The scope change (S:C, guest→host) is genuine and appropriate. On exploitation signals there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data - this is a stable-tree hardening fix, not an observed in-the-wild issue. Bottom line: real but modest priority for arm64 KVM host operators (patch in normal cadence), not a drop-everything item; the headline 9.3 is inflated relative to a DoS-dominant, guest-privilege-required local bug. Note the input CVSS is labeled 3.1 but the 9.3 figure does not match a standard 3.1 computation of that vector (~8.4) - verify scoring version with the vendor.

An attacker who already controls a guest VM on an arm64 KVM host issues crafted range-based TLBI operations with high (sign-relevant) virtual addresses; the missing sign-extension causes the hypervisor to invalidate the wrong VA range (or overflow PA bits on S2), corrupting host TLB state and degrading or crashing the host or co-tenant guests. No public exploit code is identified in the provided data, and exploitation requires vCPU-level control of a guest rather than remote access.