CVE-2026-89981

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64: Don't read GMID_EL1 when MTE is disabled

__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw

ID_AA64PFR1_EL1, so it reads the register even when the kernel has

disabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5

in that case, and pKVM injects an UNDEF the host cannot handle:

Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP

pc : __cpuinfo_store_cpu+0xf4/0x264

Kernel panic - not syncing: Attempted to kill the idle task!

Only pKVM reaches it, and only after a CPU is offlined and brought back

online: its CPU_ON relay sets the host HCR before the CPU enters EL1,

while plain nVHE sets it at CPUHP_AP_KVM_ONLINE.

Gate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line

override applied, and on CONFIG_ARM64_MTE, which no register reflects.

The boot CPU stores its registers before init_cpu_features() strips an

unsafe override, so clamp against the har

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References