« Volver al listado

CVE-2026-89911

Estado: RecibidaAlta (7.9)—

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Correctly cap TLBI Range to the architural limit

TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means it is pretty easy for a guest to generate an overflow should the hypervisor be naive enough to add the range to the base...

Make sure the range is capped to the limit dictated by the address bit that determines the VA range. For an IPA invalidation, this is further corrected down the line to ignore the upper range.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en KVM arm64 con vector AV:L/PR:L permite a huésped local causar desbordamiento de rango TLBI, escalada de privilegios (T1068). El impacto A:H sugiere DoS; C:L e I:L indican corrupción potencial de datos en memoria compartida hypervisor-guest.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageFilter Network TrafficExecution PreventionEncrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89911",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.9,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
              "lessThan": "566b1f08d983615f731cc693f2ad59db302c6b57",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
              "lessThan": "2de38f0448b45d27eba984fc0d9edb7a138972c2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929",
              "lessThan": "69a598288195947a1662b53de702eb6976af96b7",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-16T11:17:00.127",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2de38f0448b45d27eba984fc0d9edb7a138972c2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/566b1f08d983615f731cc693f2ad59db302c6b57",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/69a598288195947a1662b53de702eb6976af96b7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Correctly cap TLBI Range to the architural limit\n\nTLB Invalidation by Range has a fairly powerful way of encoding pretty\nlarge ranges in a small number of bits. This range can be based on an\narbitrary VA, which means it is pretty easy for a guest to generate an\noverflow should the hypervisor be naive enough to add the range to the\nbase...\n\nMake sure the range is capped to the limit dictated by the address bit\nthat determines the VA range. For an IPA invalidation, this is further\ncorrected down the line to ignore the upper range."
    }
  ],
  "lastModified": "2026-09-16T15:18:17.300",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}