https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 15:53:32 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89915 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>KVM: arm64: Remove VM-wide VNCR mapping counter</p> <p>The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when a mapping is made in the fixmap, and decremented when unmapped.</p> <p>As it turns out, this tracking has several flaws:</p> <p>- we are trying to invalidate TLBs, and the mapping is only an opportunistic consequence of the TLB. Checking this counter to decide whether a TLB needs to be invalidated may result in missed invalidations.</p> <p>- an L1 vcpu invalidating its own TLB (a very likely case) will not succeed in invalidating the VNCR pseudo TLB because that page is not mapped in L0 at this stage.</p> <p>Given that this tracking fails at delivering the minimum guarantees that are required and is only a performance optimisation, remove it completely.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>KVM: arm64: Remove VM-wide VNCR mapping counter</p> <p>The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when a mapping is made in the fixmap, and decremented when unmapped.</p> <p>As it turns out, this tracking has several flaws:</p> <p>- we are trying to invalidate TLBs, and the mapping is only an opportunistic consequence of the TLB. Checking this counter to decide whether a TLB needs to be invalidated may result in missed invalidations.</p> <p>- an L1 vcpu invalidating its own TLB (a very likely case) will not succeed in invalidating the VNCR pseudo TLB because that page is not mapped in L0 at this stage.</p> <p>Given that this tracking fails at delivering the minimum guarantees that are required and is only a performance optimisation, remove it completely.</p> https://vulnerability.circl.lu/vuln/cve-2026-89915