CVE-2026-89908

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the LoongArch KVM implementation where the kvm arch prepare memory region() function fails to preserve architecture-specific flags during a KVM MR FLAGS ONLY update. Because the generic code allocates a zeroed memslot and does not copy the previous architecture flags, the active memslot's arch.flags are reset to zero. This causes the fault supports huge mapping() function to bypass necessary verification of the Guest Physical Address (GPA) and Host Virtual Address (HVA) offsets within a Page Middle Directory (PMD). Consequently, a memslot previously marked as KVM MEM HUGEPAGE INCAPABLE due to an offset mismatch may be incorrectly mapped with PMD entries during read faults. Since kvm map page() aligns the Guest Frame Number (GFN) and Page Frame Number (PFN) independently, the guest may access incorrect host pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.