CVE-2026-89914 KVM: arm64: Sign-extend VA for range-based TLBI invalidation

Critical 9.3 Published 16 Sep 2026 Updated 19 Oct 2026

Missing sign extension in KVM arm64 TLBI invalidation logic could lead to incorrect memory management behavior, requiring a kernel patch.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-89914?

CVE-2026-89914 is a critical vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Sign-extend VA for range-based TLBI invalidation

When the decode_range_tlbi() helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it.

As a result, special care must be taken to not overflow PA bits when this is used for S2 invalidation.

Which versions are affected by CVE-2026-89914?

How do I fix CVE-2026-89914?

Apply the vendor's patch.

Is CVE-2026-89914 being exploited?

There is no known exploitation of CVE-2026-89914 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2026-89914, DEBIAN-CVE-2026-89914, GHSA-qcff-3h48-22j7, UBUNTU-CVE-2026-89914.