CVE-2026-89981: arm64: Don't read GMID_EL1 when MTE is disabled
In the Linux kernel, the following vulnerability has been resolved:
arm64: Don't read GMIDEL1 when MTE is disabled
cpuinfostorecpu() gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE (CONFIGARM64MTE=n or arm64.nomte). KVM sets HCREL2.TID5 in that case, and pKVM injects an UNDEF the host cannot handle:
Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP pc : cpuinfostorecpu+0xf4/0x264 Kernel panic - not syncing: Attempted to kill the idle task!
Only pKVM reaches it, and only after a CPU is offlined and brought back online: its CPUON relay sets the host HCR before the CPU enters EL1, while plain nVHE sets it at CPUHPAPKVMONLINE.
Gate the read on the CPU's own IDAA64PFR1EL1 with the command-line override applied, and on CONFIGARM64MTE, which no register reflects. The boot CPU stores its registers before initcpufeatures() strips an unsafe override, so clamp against the hardware value here too.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this failure?
The issue is limited to arm64 systems using protected KVM (pKVM). It requires MTE to be disabled, either through CONFIG_ARM64_MTE=n or the arm64.nomte command-line option.
What event is needed to trigger the kernel panic?
A CPU must be offlined and then brought back online. In the affected pKVM path, the CPU_ON relay sets the host HCR before the CPU enters EL1, allowing the invalid GMID_EL1 read to cause an unhandled undefined-instruction exception.
Are ordinary non-pKVM KVM deployments affected by the described path?
No. The description states that only pKVM reaches this condition; plain nVHE sets the relevant control state later, at CPUHP_AP_KVM_ONLINE.
How would an affected system present when triggered?
The host can report an undefined-instruction Oops in __cpuinfo_store_cpu and then panic, including messages such as "Kernel panic - not syncing: Attempted to kill the idle task!"