{"id":"CVE-2026-89981","revision":"b6b38723dbdf45e39d0eba71949562a6","records":[{"revision":"b6b38723dbdf45e39d0eba71949562a6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89981","aliases":[],"title":"arm64: Don't read GMID_EL1 when MTE is disabled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Don't read GMID_EL1 when MTE is disabled\n\n__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw\nID_AA64PFR1_EL1, so it reads the register even when the kernel has\ndisabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5\nin that case, and pKVM injects an UNDEF the host cannot handle:\n\n  Internal error: Oops - Undefined instruction: 0000000002000000 [#1]  SMP\n  pc : __cpuinfo_store_cpu+0xf4/0x264\n  Kernel panic - not syncing: Attempted to kill the idle task!\n\nOnly pKVM reaches it, and only after a CPU is offlined and brought back\nonline: its CPU_ON relay sets the host HCR before the CPU enters EL1,\nwhile plain nVHE sets it at CPUHP_AP_KVM_ONLINE.\n\nGate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line\noverride applied, and on CONFIG_ARM64_MTE, which no register reflects.\nThe boot CPU stores its registers before init_cpu_features() strips an\nunsafe override, so clamp against the hardware value here too.","state":0,"publishedAt":"2026-09-16T10:32:58.056+00:00","modifiedAt":"2026-10-19T08:55:55.85+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/include/asm/cpu.h\",\n                        \"arch/arm64/include/asm/cpufeature.h\",\n                        \"arch/arm64/kernel/cpufeature.c\",\n                        \"arch/arm64/kernel/cpuinfo.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f35abcbb8a084db4c24b66ccc8db0405c08e2f61\",\n                            \"lessThan\": \"d2d22ff377cd43f2e9660426ff22e3cd4c534637\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f35abcbb8a084db4c24b66ccc8db0405c08e2f61\",\n                            \"lessThan\": \"5445d64199626974269fcdf347769ad44b0bb53b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/include/asm/cpu.h\",\n                        \"arch/arm64/include/asm/cpufeature.h\",\n                        \"arch/arm64/kernel/cpufeature.c\",\n                        \"arch/arm64/kernel/cpuinfo.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/d2d22ff377cd43f2e9660426ff22e3cd4c534637","https://git.kernel.org/stable/c/5445d64199626974269fcdf347769ad44b0bb53b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89981","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89981","identifiers":["CVE-2026-89981"]},"retained":false,"historicalAffected":[]}],"coverage":[]}