PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89929 Linux CVE debrief

A Linux kernel vulnerability allows KVM to incorrectly emulate INVVPID on a different physical CPU than where L2 is running, potentially leaving TLB entries uninvalidated. This issue can lead to unexpected behavior in virtualized environments. The vulnerability arises from KVM's INVVPID emulation not being executed on the same physical CPU as L2, causing inconsistencies in TLB entries. This can result in system instability, crashes, or potential exposure to denial-of-service (DoS) attacks. Defenders managing virtualized environments using KVM should assess exposure and prioritize patching or mitigation to prevent potential TLB entry inconsistencies and unexpected behavior.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-16
Original CVE updated
2026-10-21
Advisory published
2026-09-16
Advisory updated
2026-10-21

Who should care

Defenders managing virtualized environments using KVM, especially those with L2 guests migrated across physical CPUs, should assess exposure and prioritize patching or mitigation to prevent potential TLB entry inconsistencies and unexpected behavior. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for maintaining the integrity and security of virtualized environments.

Why it matters

Defenders should prioritize patching or mitigating CVE-2026-89929 in virtualized environments using KVM, especially where L2 guests are migrated across physical CPUs, to prevent potential TLB entry inconsistencies and unexpected behavior.

  • Potential for TLB entries to remain uninvalidated, leading to unexpected behavior
  • Increased risk of virtualized environment instability or crashes
  • Possible exposure to denial-of-service (DoS) attacks

Technical summary

The Linux kernel's KVM feature incorrectly emulates INVVPID on a different physical CPU than where L2 is running. This can lead to TLB entries not being properly invalidated, causing unexpected behavior in virtualized environments. The vulnerability is resolved in Linux kernel commits 1759a565a25c814ced9281a708749c71fa69d6fe, d03e721801ac54b9fdf05668aa0c069f07913b68, 27bdeb5fd19046ffba9ff234e92fe553eb2efb30, 9941850e8adf164d005dbd3774c4b79e91a3cb8e, and 6d00e67326d831e6e610933a3800712f4ffe6ec1. Defenders should prioritize patching or mitigating this vulnerability in virtualized environments using KVM, especially where L2 guests are migrated across physical CPUs.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability in virtualized environments using KVM, especially where L2 guests are migrated across physical CPUs.

Recommended defensive actions

  • Apply patches from Linux kernel commits 1759a565a25c814ced9281a708749c71fa69d6fe, d03e721801ac54b9fdf05668aa0c069f07913b68, 27bdeb5fd19046ffba9ff234e92fe553eb2efb30, 9941850e8adf164d005dbd3774c4b79e91a3cb8e, or 6d00e6736
  • Verify and apply relevant Linux distribution patches
  • Monitor virtualized environments for unexpected behavior related to L2 guest migrations
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is resolved in Linux kernel commits 1759a565a25c814ced9281a708749c71fa69d6fe, d03e721801ac54b9fdf05668aa0c069f07913b68, 27bdeb5fd19046ffba9ff234e92fe553eb2efb30, 9941850e8adf164d005dbd3774c4b79e91a3cb8e, and 6d00e67326d831e6e610933a3800712f4ffe6ec1.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89929 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89929

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89929 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89929

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89929.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1759a565a25c814ced9281a708749c71fa69d6fe

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d03e721801ac54b9fdf05668aa0c069f07913b68

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/27bdeb5fd19046ffba9ff234e92fe553eb2efb30

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9941850e8adf164d005dbd3774c4b79e91a3cb8e

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6d00e67326d831e6e610933a3800712f4ffe6ec1

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.