CVE-2026-89928

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk

__kvm_rmap_lock() deliberately elides the rmap lock when it observes an

empty rmap. In that case kvm_rmap_lock_readonly() also re-enables

preemption and returns zero, so the caller holds neither the rmap lock

nor a preemption reference. The elision documents the invariant it

relies on:

* Elide the lock if the rmap is empty, as lockless walkers (read-only

* mode) don't need to (and can't) walk an empty rmap, nor can they add

* entries to the rmap. I.e. the only paths that process empty rmaps

* do so while holding mmu_lock for write, and are mutually exclusive.

kvm_rmap_age_gfn_range() ignores the returned value and unconditionally

enters for_each_rmap_spte_lockless(). The iterator started with

rmap_get_first(), which re-reads rmap_head->val rather than using the

value returned by the lock. If a writer populates the rmap between the

lo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References