CVE-2026-89908

Status: UPDATED  |  Advisory ID: CVE-2026-89908

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY

kvm_arch_prepare_memory_region() computes new->arch.flags, i.e. whether

a memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE,

only for KVM_MR_CREATE and KVM_MR_MOVE, and returns early for every

other change. But the generic code allocates a zeroed memslot for every

change and never copies old->arch, so after a KVM_MR_FLAGS_ONLY update,

e.g. toggling KVM_MEM_LOG_DIRTY_PAGES for live migration, the active

memslot has arch.flags == 0.

With both flags clear, fault_supports_huge_mapping() falls through to

the alignment check on the HVA range alone, which no longer verifies

that the GPA and HVA have the same offset within a PMD. A memslot that

was marked KVM_MEM_HUGEPAGE_INCAPABLE because of a GPA/HVA offset

mismatch can then be mapped with PMD entries on read faults, and since

kvm_map_page() aligns the gfn and the pfn independently, the guest ends

up accessing the wrong host pages, exactly the "d -> f, e -> g" case

described in the comment above the check.

Carry the arch flags over from the old memslot for KVM_MR_FLAGS_ONLY,

as the GPA, HVA and size are guaranteed to be unchanged for that case. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References