---
id: CVE-2026-89981
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: Don't read GMID_EL1 when MTE is disabled

  __cpuinfo_store_cpu() gates the GMID_EL1 read on the raw
  ID_AA64PFR1_EL1, so it reads the register even when the kernel…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: Don't read GMID_EL1 when MTE is disabled

  __cpuinfo_store_cpu() gates the GMID_EL1 read on the raw
  ID_AA64PFR1_EL1, so it reads the register even when the kernel…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f35abcbb8a084db4c24b66ccc8db0405c08e2f61 <
    d2d22ff377cd43f2e9660426ff22e3cd4c534637
  - >-
    Linux >= f35abcbb8a084db4c24b66ccc8db0405c08e2f61 <
    5445d64199626974269fcdf347769ad44b0bb53b
  - Linux 7.0
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T11:17:09.037'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89981'
references:
  - url: 'https://git.kernel.org/stable/c/5445d64199626974269fcdf347769ad44b0bb53b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d2d22ff377cd43f2e9660426ff22e3cd4c534637'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.953Z'
epss: 0.00189
epssPercentile: 0.08806
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

arm64: Don't read GMID_EL1 when MTE is disabled

__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw
ID_AA64PFR1_EL1, so it reads the register even when the kernel has
disabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5
in that case, and pKVM injects an UNDEF the host cannot handle:

  Internal error: Oops - Undefined instruction: 0000000002000000 [#1]  SMP
  pc : __cpuinfo_store_cpu+0xf4/0x264
  Kernel panic - not syncing: Attempted to kill the idle task!

Only pKVM reaches it, and only after a CPU is offlined and brought back
online: its CPU_ON relay sets the host HCR before the CPU enters EL1,
while plain nVHE sets it at CPUHP_AP_KVM_ONLINE.

Gate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line
override applied, and on CONFIG_ARM64_MTE, which no register reflects.
The boot CPU stores its registers before init_cpu_features() strips an
unsafe override, so clamp against the hardware value here too.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.