Vulnerability-Lookup

FKIE_CVE-2026-89908

Vulnerability from fkie_nvd - Published: 2026-09-16 11:16 - Updated: 2026-09-16 15:18

Severity

8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY kvm_arch_prepare_memory_region() computes new->arch.flags, i.e. whether a memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE, only for KVM_MR_CREATE and KVM_MR_MOVE, and returns early for every other change. But the generic code allocates a zeroed memslot for every change and never copies old->arch, so after a KVM_MR_FLAGS_ONLY update, e.g. toggling KVM_MEM_LOG_DIRTY_PAGES for live migration, the active memslot has arch.flags == 0. With both flags clear, fault_supports_huge_mapping() falls through to the alignment check on the HVA range alone, which no longer verifies that the GPA and HVA have the same offset within a PMD. A memslot that was marked KVM_MEM_HUGEPAGE_INCAPABLE because of a GPA/HVA offset mismatch can then be mapped with PMD entries on read faults, and since kvm_map_page() aligns the gfn and the pfn independently, the guest ends up accessing the wrong host pages, exactly the "d -> f, e -> g" case described in the comment above the check. Carry the arch flags over from the old memslot for KVM_MR_FLAGS_ONLY, as the GPA, HVA and size are guaranteed to be unchanged for that case.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/27a9bfee3bbcb3cabb77797354f07e0e44e49831
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4e4dbc341b1581dc512b85d98b768373b0398366
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8",
              "status": "affected",
              "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c",
              "versionType": "git"
            },
            {
              "lessThan": "4e4dbc341b1581dc512b85d98b768373b0398366",
              "status": "affected",
              "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c",
              "versionType": "git"
            },
            {
              "lessThan": "bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba",
              "status": "affected",
              "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c",
              "versionType": "git"
            },
            {
              "lessThan": "27a9bfee3bbcb3cabb77797354f07e0e44e49831",
              "status": "affected",
              "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY\n\nkvm_arch_prepare_memory_region() computes new-\u003earch.flags, i.e. whether\na memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE,\nonly for KVM_MR_CREATE and KVM_MR_MOVE, and returns early for every\nother change. But the generic code allocates a zeroed memslot for every\nchange and never copies old-\u003earch, so after a KVM_MR_FLAGS_ONLY update,\ne.g. toggling KVM_MEM_LOG_DIRTY_PAGES for live migration, the active\nmemslot has arch.flags == 0.\n\nWith both flags clear, fault_supports_huge_mapping() falls through to\nthe alignment check on the HVA range alone, which no longer verifies\nthat the GPA and HVA have the same offset within a PMD. A memslot that\nwas marked KVM_MEM_HUGEPAGE_INCAPABLE because of a GPA/HVA offset\nmismatch can then be mapped with PMD entries on read faults, and since\nkvm_map_page() aligns the gfn and the pfn independently, the guest ends\nup accessing the wrong host pages, exactly the \"d -\u003e f, e -\u003e g\" case\ndescribed in the comment above the check.\n\nCarry the arch flags over from the old memslot for KVM_MR_FLAGS_ONLY,\nas the GPA, HVA and size are guaranteed to be unchanged for that case."
    }
  ],
  "id": "CVE-2026-89908",
  "lastModified": "2026-09-16T15:18:17.050",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-16T11:16:59.807",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/27a9bfee3bbcb3cabb77797354f07e0e44e49831"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4e4dbc341b1581dc512b85d98b768373b0398366"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-89908 (GCVE-0-2026-89908)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:32 – Updated: 2026-09-16 14:39

Title

LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/7c6df65b53846cd7a…
https://git.kernel.org/stable/c/4e4dbc341b1581dc5…
https://git.kernel.org/stable/c/bc7a6849b4395f45a…
https://git.kernel.org/stable/c/27a9bfee3bbcb3cab…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c , < 7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8 (git) Affected: 7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c , < 4e4dbc341b1581dc512b85d98b768373b0398366 (git) Affected: 7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c , < bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba (git) Affected: 7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c , < 27a9bfee3bbcb3cabb77797354f07e0e44e49831 (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8",
              "status": "affected",
              "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c",
              "versionType": "git"
            },
            {
              "lessThan": "4e4dbc341b1581dc512b85d98b768373b0398366",
              "status": "affected",
              "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c",
              "versionType": "git"
            },
            {
              "lessThan": "bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba",
              "status": "affected",
              "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c",
              "versionType": "git"
            },
            {
              "lessThan": "27a9bfee3bbcb3cabb77797354f07e0e44e49831",
              "status": "affected",
              "version": "7ab6fb505b2a7447c4a7237a12c59e3ad0c7298c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY\n\nkvm_arch_prepare_memory_region() computes new-\u003earch.flags, i.e. whether\na memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE,\nonly for KVM_MR_CREATE and KVM_MR_MOVE, and returns early for every\nother change. But the generic code allocates a zeroed memslot for every\nchange and never copies old-\u003earch, so after a KVM_MR_FLAGS_ONLY update,\ne.g. toggling KVM_MEM_LOG_DIRTY_PAGES for live migration, the active\nmemslot has arch.flags == 0.\n\nWith both flags clear, fault_supports_huge_mapping() falls through to\nthe alignment check on the HVA range alone, which no longer verifies\nthat the GPA and HVA have the same offset within a PMD. A memslot that\nwas marked KVM_MEM_HUGEPAGE_INCAPABLE because of a GPA/HVA offset\nmismatch can then be mapped with PMD entries on read faults, and since\nkvm_map_page() aligns the gfn and the pfn independently, the guest ends\nup accessing the wrong host pages, exactly the \"d -\u003e f, e -\u003e g\" case\ndescribed in the comment above the check.\n\nCarry the arch flags over from the old memslot for KVM_MR_FLAGS_ONLY,\nas the GPA, HVA and size are guaranteed to be unchanged for that case."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached from a LoongArch KVM guest page fault on the host KVM_RUN path (kvm_arch_vcpu_ioctl_run -\u003e kvm_handle_exit -\u003e kvm_handle_fault -\u003e kvm_handle_mm_fault -\u003e kvm_map_page) after KVM_SET_USER_MEMORY_REGION FLAGS_ONLY; there is no network or physical path.\nAC:L - After FLAGS_ONLY zeros memslot arch.flags, a guest load to an interior GPA of a GPA/HVA-offset-mismatched slot with host THP backing deterministically installs a PMD because kvm_map_page aligns gfn and pfn independently; the VMM chooses the memslot and dirty-log toggle, and THP is a common default, not a rare config or uncontrolled race.\nPR:L - A tenant guest or a host kvm-group user running QEMU is sufficient: /dev/kvm and kvm_vm_ioctl() have no capable() check, and the fault path has none either. Init-namespace root is not required, so this is Low rather than High.\nUI:N - The attacker guest issues the faulting load or store itself during KVM_RUN; no separate victim action such as mounting a filesystem, opening a crafted file, or confirming a prompt is required.\nS:C - kvm_map_page installs stage-2 PMD entries that bind guest GPAs to the wrong host PFNs, breaking the hypervisor GPA-to-HVA contract and crossing the KVM guest-to-host isolation boundary, which CNA guidance rates Changed for KVM guest-to-host escape.\nC:H - On read faults, fault_supports_huge_mapping() allows a PMD that maps the guest onto the wrong host pages (the commit\u0027s d-\u003ef, e-\u003eg case), giving the guest an unauthorized read of the host physical pages backing that 2MB block.\nI:H - After dirty logging is toggled off (another FLAGS_ONLY that also leaves arch.flags at 0), write faults install writable huge mappings to those same wrong host PFNs, so the guest can modify host pages the memslot did not bind to that GPA.\nA:H - Aliased stage-2 PMDs scramble guest RAM and, during live migration, produce a corrupted destination image that can crash the VM; incorrect huge PFNs can also oops the host if the aligned range is not valid RAM, denying service to the hypervisor and co-located VMs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:58.684Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7c6df65b53846cd7a9a1c81c6ddb42fdc08603e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e4dbc341b1581dc512b85d98b768373b0398366"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc7a6849b4395f45a602db91b0fb2fb2e9ed4bba"
        },
        {
          "url": "https://git.kernel.org/stable/c/27a9bfee3bbcb3cabb77797354f07e0e44e49831"
        }
      ],
      "title": "LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89908",
    "datePublished": "2026-09-16T10:32:06.599Z",
    "dateReserved": "2026-09-11T19:38:34.774Z",
    "dateUpdated": "2026-09-16T14:39:58.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-89908

CVE-2026-89908 (GCVE-0-2026-89908)

Tags

Sightings

Nomenclature

Related by attack behaviour