CVE-2026-89775
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel's KVM for arm64, pgshift_level_to_ttl() does not handle negative levels (e.g. -127 indicating S1 MMU disabled), incorrectly computing the TLB invalidation size as 0. The fix handles negative levels and makes ttl_to_size() return SZ_1G when no valid TTL is present.
Risk Assessment
Incorrect TLB invalidation size computation may lead to incomplete TLB flushes, potentially causing memory inconsistencies and errors or isolation gaps in virtual machines.
Recommendation
Update the Linux kernel to a version containing the fix for negative levels in pgshift_level_to_ttl() and ttl_to_size(). Applying the update on arm64 virtualization hosts is recommended.
Related vulnerabilities
- CVE-2026-92398Critical
A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380 within the user_list_note module in the file /etc/rg_config/admin. Manipulation of the Name argument leads to OS command injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-76420Critical
A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. The issue is due to incorrect initialization of encryption parameters for the AJP connector at boot time. A successful exploit could allow the attacker to execute commands as root and gain full control over the FMC REST APIs, but only if the sftunnel connection between FMC and FTD is down.
- CVE-2026-20331Critical
Cisco conducted an internal security review that resulted in a software hardening release addressing multiple internally discovered vulnerabilities in Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software. The vulnerabilities tracked by CVE-2026-20331 relate to failure of protection mechanisms (CWE-693).
- CVE-2026-20307Critical
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The attacker must have at least low-privileged administrative credentials. The issue is due to insecure deserialization of a user-supplied Java byte stream; successful exploitation could allow code execution and privilege escalation to root, and in single-node deployments could cause the ISE node to become unavailable (DoS).
- CVE-2026-20306Critical
A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).
- CVE-2026-20305Critical
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).
- CVE-2026-20234Critical
Cisco conducted an internal security review that resulted in a software hardening release addressing multiple internally discovered vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The vulnerabilities tracked by CVE-2026-20234 relate to insufficiently protected credentials (CWE-522).
- CVE-2026-92397Critical
A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380 within the cc_set function of the file unifyframe-sgi.elf in the configChange component. Manipulation of the data.url argument leads to OS command injection. The attack may be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-70416Critical
Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote code execution.
- CVE-2025-59953Critical
LMDeploy implements an RPC server (AsyncRPCServer in zmq_rpc.py) whose call_and_response() function deserializes received messages using pickles.loads() without any sanitization. This allows remote code execution through the RPC server. The vulnerability exists from version 0.9.1 up to 0.10.2, where it is patched.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from the combination of the base granule size and the mapping level. However, this implies that the S1 MMU is *on*. When the MMU is off, we indicate this with the level being set to a "creative" value of -127 (S1_MMU_DISABLED). This ends-up being misinterpreted by pgshift_level_to_ttl() as it doesn't handle negative levels at all (the level is immediately cast to a u8 and only the bottom two bits considered), leading to an invalidation size of 0. Not helpful. Tidy-up pgshift_level_to_ttl() to handle these negative levels, and ttl_to_size() to always return SZ_1G when no valid TTL is present. This allows the removal of open-coded checks for similar situations. Note that the check for a negative value not explicitely checking for S1_MMU_DISABLED is deliberate, so that actual negative levels introduced with LVA2 and D128 can take the same path if we ever support them.