CVE-2026-89775: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89775 is a Linux kernel vulnerability in the KVM arm64 subsystem where the pgshift_level_to_ttl() function mishandles negative Stage 1 (S1) MMU walk level values during VNCR TLB size evaluation. When the S1 MMU is disabled, the kernel uses a sentinel value of -127 (S1_MMU_DISABLED) to indicate this state; however, the function casts this value directly to u8 and considers only the bottom two bits, resulting in an incorrect TLB invalidation size of 0. The vulnerability affects Linux kernel version 6.16 through commits prior to the fix, with patched versions available in 6.18.51, 7.2.5, and 7.3-rc1. The CVSS base score is listed as 0.0 with a medium severity estimate, reflecting its local, low-impact nature (GitHub Advisory, Feedly).

The root cause is improper handling of a signed integer sentinel value (S1_MMU_DISABLED = -127) in the pgshift_level_to_ttl() function within the Linux kernel's KVM arm64 code. When computing TLB invalidation size for S1 mappings like VNCR, the function assumes the S1 MMU is active and derives the mapping level from the granule size; when the MMU is off, the negative sentinel is cast to u8, causing only the lowest two bits to be evaluated and producing an invalidation size of 0. The fix tidies up pgshift_level_to_ttl() to properly detect and handle negative levels, and updates ttl_to_size() to return SZ_1G when no valid TTL is present — a deliberate design choice to also accommodate future negative levels from LVA2 and D128 extensions. No CWE classification has been formally assigned (GitHub Advisory).

A local user with the ability to trigger TLB invalidation operations on a KVM-enabled arm64 system can cause incorrect TLB size calculations, leading to improper TLB invalidation behavior. This may result in system instability, incorrect memory mapping behavior, or denial of service conditions on the affected host. The impact is confined to the local system and does not directly enable remote code execution or privilege escalation based on available information (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (September 16, 2026). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access to a KVM arm64 system and the ability to trigger TLB invalidation operations (GitHub Advisory, Feedly).

Update the Linux kernel to a version containing the fix: 6.18.51 (for the 6.18.x stable branch), 7.2.5 (for the 7.2.x branch), or 7.3-rc1 and later. The fix is available via three stable kernel commits: be54a70067c7dbe1381157e8a238fa4b16ea9c05, 1c9fca34b9625a67a7f1a03c8604f3df760c6c49, and 8053393680d4fa3eb962667d2be95dd39f0940e5. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (GitHub Advisory).