Linux Kernel CVE-2026-89915

Requires an arm64 host with KVM nested virtualization enabled (FEAT_NV2 / VNCR page support, kernel 6.16+) AND the attacker controlling a running L1 guest that can issue TLB invalidations - this is a guest-to-host (L1-to-L0) boundary crossing, so exploitation is local to the host and requires guest-vCPU privileges, contradicting the vendor's PR:N. Limiting factors: the affected feature is nested virtualization, which is off by default and deployed on only a small subset of arm64 KVM hosts; the missed-invalidation window is opportunistic and mapping-state-dependent, making reliable weaponization into cross-boundary read/write timing-sensitive rather than deterministic.

The vendor CVSS of 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) substantially overstates real-world risk. This is a KVM arm64 nested-virtualization bug: a VM-wide counter tracking whether an L1-provided VNCR page is fixmap-mapped in L0 was used to gate TLB invalidation, causing MISSED invalidations (the commit explicitly notes an L1 vCPU invalidating its own TLB commonly fails to invalidate the VNCR pseudo-TLB). Key conflicts with the vendor vector: PR:N is implausible - exploitation requires the attacker to control a running L1 guest vCPU under a nested-virt-enabled host, which is at minimum PR:L; and AC:L is questionable because turning a missed invalidation (stale translation) into a concrete cross-boundary confidentiality/integrity impact is timing- and layout-dependent (AC:H). S:C (guest→host / L1→L0 boundary) is the one clearly-correct escalation metric. The C:H/I:H/A:H triad is overstated: the dominant realistic outcome is stale-TLB-driven denial of service or memory-isolation corruption, with cross-guest information disclosure plausible but not demonstrated. No EPSS, no KEV, and no public exploit code accompany this entry, and there is no SSVC decision data - no signal of automatable or in-the-wild exploitation. Net: a genuine host-security correctness bug worth patching on affected hosts, but its true risk is gated hard by the rarity of arm64 nested virtualization, not the 9.3 headline.

On an arm64 host running KVM nested virtualization (FEAT_NV2), a malicious or compromised L1 guest performs TLB invalidations that the flawed VNCR mapping counter causes L0 to skip, leaving stale VNCR pseudo-TLB translations valid. The L1/L2 guest then reads or writes through the stale mapping, breaking memory isolation and potentially corrupting host/guest state or leaking data. No public exploit code is identified at time of analysis; realistic exploitation is timing- and layout-sensitive and confined to nested-virt hosts.