---
id: CVE-2026-89911
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: Correctly cap TLBI Range to the architural limit

  TLB Invalidation by Range has a fairly powerful way of encoding pretty
  large ranges in a small number of b…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: arm64: Correctly cap TLBI Range to the architural limit

  TLB Invalidation by Range has a fairly powerful way of encoding pretty
  large ranges in a small number of b…
severity: high
cvss: 7.9
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 <
    566b1f08d983615f731cc693f2ad59db302c6b57
  - >-
    Linux >= 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 <
    2de38f0448b45d27eba984fc0d9edb7a138972c2
  - >-
    Linux >= 4ffa72ad8f37e73bbb6c0baa88557bcb4fd39929 <
    69a598288195947a1662b53de702eb6976af96b7
  - Linux 6.16
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:17.300'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89911'
references:
  - url: 'https://git.kernel.org/stable/c/2de38f0448b45d27eba984fc0d9edb7a138972c2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/566b1f08d983615f731cc693f2ad59db302c6b57'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/69a598288195947a1662b53de702eb6976af96b7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.975Z'
epss: 0.00159
epssPercentile: 0.0423
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Correctly cap TLBI Range to the architural limit

TLB Invalidation by Range has a fairly powerful way of encoding pretty
large ranges in a small number of bits. This range can be based on an
arbitrary VA, which means it is pretty easy for a guest to generate an
overflow should the hypervisor be naive enough to add the range to the
base...

Make sure the range is capped to the limit dictated by the address bit
that determines the VA range. For an IPA invalidation, this is further
corrected down the line to ignore the upper range.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.