{"id":"CVE-2026-89981","title":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Don't read GMID_EL1 when MTE is disabled\n\n__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw\nID_AA64PFR1_EL1, so it reads the register even when the kernel…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Don't read GMID_EL1 when MTE is disabled\n\n__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw\nID_AA64PFR1_EL1, so it reads the register even when the kernel…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= f35abcbb8a084db4c24b66ccc8db0405c08e2f61 < d2d22ff377cd43f2e9660426ff22e3cd4c534637","Linux >= f35abcbb8a084db4c24b66ccc8db0405c08e2f61 < 5445d64199626974269fcdf347769ad44b0bb53b","Linux 7.0"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T11:17:09.037","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89981","references":[{"url":"https://git.kernel.org/stable/c/5445d64199626974269fcdf347769ad44b0bb53b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2d22ff377cd43f2e9660426ff22e3cd4c534637","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:53.953Z","epss":0.00189,"epssPercentile":0.08812,"slug":"CVE-2026-89981","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: Don't read GMID_EL1 when MTE is disabled\n\n__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw\nID_AA64PFR1_EL1, so it reads the register even when the kernel has\ndisabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5\nin that case, and pKVM injects an UNDEF the host cannot handle:\n\n  Internal error: Oops - Undefined instruction: 0000000002000000 [#1]  SMP\n  pc : __cpuinfo_store_cpu+0xf4/0x264\n  Kernel panic - not syncing: Attempted to kill the idle task!\n\nOnly pKVM reaches it, and only after a CPU is offlined and brought back\nonline: its CPU_ON relay sets the host HCR before the CPU enters EL1,\nwhile plain nVHE sets it at CPUHP_AP_KVM_ONLINE.\n\nGate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line\noverride applied, and on CONFIG_ARM64_MTE, which no register reflects.\nThe boot CPU stores its registers before init_cpu_features() strips an\nunsafe override, so clamp against the hardware value here too.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}