{"id":24605,"date":"2026-09-16T20:32:32","date_gmt":"2026-09-16T12:32:32","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89918"},"modified":"2026-09-16T20:32:32","modified_gmt":"2026-09-16T12:32:32","slug":"cve-2026-89918","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89918","title":{"rendered":"CVE-2026-89918 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Correctly"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>KVM: arm64: Correctly handle end of VA space TLBI invalidation<\/p>\n<p>Our TLB invalidation by VA code is based on comparing two ranges,<br \/>\none defined by the TLB, and one defined by the TLBI instruction.<\/p>\n<p>Each range is defined by a start and a size. However, the way the<br \/>\ncomparison is done doesn&#8217;t account for address rollover, as it<br \/>\ncompares an address with (base + size). This works nicely until<br \/>\nthis expression represent the last page\/block in the TTBR1 VA space,<br \/>\nas the result is a big fat 0. And a failed TLB invalidation.<\/p>\n<p>Rewrite the comparison in a way that is immune to the address<br \/>\nrollover (making the end address inclusive instead of exclusive),<br \/>\nand move this into a common helper that is used by both VA and IPA<br \/>\ninvalidations, as suggested by Hyunwoo Kim (although the IPA version<br \/>\ndidn&#8217;t suffer from this particular problem, obviously).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>KVM: arm64: Correctly handle end of VA space TLBI invalidation<\/p>\n<p>Our TLB invalidation by VA code is based on comparing two ranges,<br \/>\no<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24605","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24605"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}