CVE-2026-89908: LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY
kvmarchpreparememoryregion() computes new->arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABLE or KVMMEMHUGEPAGEINCAPABLE, only for KVMMRCREATE and KVMMRMOVE, and returns early for every other change. But the generic code allocates a zeroed memslot for every change and never copies old->arch, so after a KVMMRFLAGSONLY update, e.g. toggling KVMMEMLOGDIRTYPAGES for live migration, the active memslot has arch.flags == 0.
With both flags clear, faultsupportshugemapping() falls through to the alignment check on the HVA range alone, which no longer verifies that the GPA and HVA have the same offset within a PMD. A memslot that was marked KVMMEMHUGEPAGEINCAPABLE because of a GPA/HVA offset mismatch can then be mapped with PMD entries on read faults, and since kvmmappage() aligns the gfn and the pfn independently, the guest ends up accessing the wrong host pages, exactly the "d -> f, e -> g" case described in the comment above the check.
Carry the arch flags over from the old memslot for KVMMRFLAGSONLY, as the GPA, HVA and size are guaranteed to be unchanged for that case.
Event History
Frequently Asked Questions
Which KVM workloads are exposed to the incorrect mapping behavior?
The affected path is specific to LoongArch KVM memslots that were classified as hugepage-incapable because the guest physical address and host virtual address have different offsets within a PMD. The condition arises after a flags-only memslot update, such as enabling or disabling dirty-page logging for live migration.
What is the impact if the affected sequence occurs?
A later read fault can install PMD mappings despite the GPA/HVA offset mismatch. Because the guest frame number and host page frame number are aligned independently, the guest can access incorrect host pages.
What condition should be checked when investigating a suspected issue?
Check whether a LoongArch KVM memslot with mismatched GPA and HVA PMD offsets underwent a KVM_MR_FLAGS_ONLY update. After such an update, the vulnerable behavior results from the active memslot losing its architecture-specific hugepage capability flags.