CVE-2026-89981: arm64: Don't read GMID_EL1 when MTE is disabled

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

arm64: Don't read GMIDEL1 when MTE is disabled

cpuinfostorecpu() gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE (CONFIGARM64MTE=n or arm64.nomte). KVM sets HCREL2.TID5 in that case, and pKVM injects an UNDEF the host cannot handle:

Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP pc : cpuinfostorecpu+0xf4/0x264 Kernel panic - not syncing: Attempted to kill the idle task!

Only pKVM reaches it, and only after a CPU is offlined and brought back online: its CPUON relay sets the host HCR before the CPU enters EL1, while plain nVHE sets it at CPUHPAPKVMONLINE.

Gate the read on the CPU's own IDAA64PFR1EL1 with the command-line override applied, and on CONFIGARM64MTE, which no register reflects. The boot CPU stores its registers before initcpufeatures() strips an unsafe override, so clamp against the hardware value here too.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 16, 2026
CVE Published
via MITRE·10:32 AM
Data Sourced
via MITRE·10:32 AM
Description

Frequently Asked Questions

1

Which systems are realistically exposed to this failure?

The issue is limited to arm64 systems using protected KVM (pKVM). It requires MTE to be disabled, either through CONFIG_ARM64_MTE=n or the arm64.nomte command-line option.

2

What event is needed to trigger the kernel panic?

A CPU must be offlined and then brought back online. In the affected pKVM path, the CPU_ON relay sets the host HCR before the CPU enters EL1, allowing the invalid GMID_EL1 read to cause an unhandled undefined-instruction exception.

3

Are ordinary non-pKVM KVM deployments affected by the described path?

No. The description states that only pKVM reaches this condition; plain nVHE sets the relevant control state later, at CPUHP_AP_KVM_ONLINE.

4

How would an affected system present when triggered?

The host can report an undefined-instruction Oops in __cpuinfo_store_cpu and then panic, including messages such as "Kernel panic - not syncing: Attempted to kill the idle task!"

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203