CVE-2026-72278

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72278", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.916Z", "datePublished": "2026-08-15T05:54:59.698Z", "dateUpdated": "2026-08-17T05:42:13.824Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:42:13.824Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Re-translate VNCR before injecting abort\n\nKVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts\nfor a write, similar to how a regular stage-2 mapping is handled. It is\nentirely possible that the guest reads from the VNCR before writing to\nit, in which case the PFN could only be read-only.\n\nInvalidate the VNCR TLB and re-fetch the translation upon taking a VNCR\nabort, allowing the host mapping to be faulted in for write the second\ntime around. Interestingly enough, this also satisfies the ordering\nrequirements of FEAT_ETS2/3 between descriptor updates and MMU faults."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.3, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached only when an arm64 nested-KVM L1 hypervisor triggers VNCR_EL2 data aborts (ESR_ELx_EC_DABT_CUR with ESR_ELx_VNCR) handled via KVM_RUN through kvm_handle_vncr_abort(); no network, adjacent-radio, or physical-device path reaches this code.\nAC:L - An attacker controlling an L1 nested-hypervisor VM can reliably issue read-then-write VNCR accesses, remap the VNCR page, and force translation/permission faults; nested virt on arm64 cloud hosts is an attacker-selectable deployment, not an uncontrollable condition.\nPR:N - Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR faults, pseudo-TLB reuse, and repeated write triggers are fully attacker-driven from within the guest.\nS:C - Stale VNCR pseudo-TLB and fixmap state lets guest-controlled faults cause host KVM to map and access the wrong guest physical pages when emulating EL2 register state, crossing the guest-to-hypervisor security boundary beyond the guest's intended authority.\nC:H - Reusing a cached VNCR translation without re-walking guest page tables can make the host read unintended guest physical pages through the per-CPU fixmap during VNCR emulation, providing a stale-translation information-disclosure primitive across guest memory views.\nI:H - Without re-translation on write aborts, a writable host fixmap established under a stale read-only fault can let the hypervisor write nested EL2 register values into the wrong guest physical page, corrupting memory the VMM expected to isolate.\nA:H - Incorrect permission/external-abort injection on VNCR write faults after a prior read leaves nested hypervisors unable to progress and can drive tight host-side fault-handling loops, causing CPU exhaustion and denial of service to co-resident workloads."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/nested.c"], "versions": [{"version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5", "lessThan": "ea7a76d7d614b5f82b4d0785f9af3550e860a71a", "status": "affected", "versionType": "git"}, {"version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5", "lessThan": "0a5dd8cf4d58ea28da132c2097cd1c525302ac48", "status": "affected", "versionType": "git"}, {"version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5", "lessThan": "bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/nested.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ea7a76d7d614b5f82b4d0785f9af3550e860a71a"}, {"url": "https://git.kernel.org/stable/c/0a5dd8cf4d58ea28da132c2097cd1c525302ac48"}, {"url": "https://git.kernel.org/stable/c/bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f"}], "title": "KVM: arm64: nv: Re-translate VNCR before injecting abort", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/kvm/nested.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ea7a76d7d614b5f82b4d0785f9af3550e860a71a", "status": "affected", "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5", "versionType": "git"}, {"lessThan": "0a5dd8cf4d58ea28da132c2097cd1c525302ac48", "status": "affected", "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5", "versionType": "git"}, {"lessThan": "bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f", "status": "affected", "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/kvm/nested.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Re-translate VNCR before injecting abort\n\nKVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts\nfor a write, similar to how a regular stage-2 mapping is handled. It is\nentirely possible that the guest reads from the VNCR before writing to\nit, in which case the PFN could only be read-only.\n\nInvalidate the VNCR TLB and re-fetch the translation upon taking a VNCR\nabort, allowing the host mapping to be faulted in for write the second\ntime around. Interestingly enough, this also satisfies the ordering\nrequirements of FEAT_ETS2/3 between descriptor updates and MMU faults."}], "id": "CVE-2026-72278", "lastModified": "2026-08-17T06:18:30.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:21:57.927", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0a5dd8cf4d58ea28da132c2097cd1c525302ac48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea7a76d7d614b5f82b4d0785f9af3550e860a71a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: KVM: arm64: nv: Re-translate VNCR before injecting abort", "id": "2516288", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516288"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-280", "details": ["A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for arm64 systems. This vulnerability occurs when a guest operating system attempts to access the Virtualization Nested Control Register (VNCR) page. If the guest reads from VNCR before writing to it, KVM may incorrectly handle the memory access, potentially leading to unexpected behavior or instability within the virtualized environment."], "name": "CVE-2026-72278", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72278\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72278\nhttps://lore.kernel.org/linux-cve-announce/2026081558-CVE-2026-72278-d0db@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a359e072596fcb2e9e85017a865e3618a2fe5b5, ea7a76d7d614b5f82b4d0785f9af3550e860a71a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a359e072596fcb2e9e85017a865e3618a2fe5b5, 0a5dd8cf4d58ea28da132c2097cd1c525302ac48)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a359e072596fcb2e9e85017a865e3618a2fe5b5, bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T10:00:06.526568+00:00", "updated": "2026-08-18T19:45:03.300707+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}