by Kastro
Paper/Archive/CVE-2026-72278

CVE-2026-72278

Linux Linux — KVM: arm64: nv: Re-translate VNCR before injecting abort

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
30
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 9.1.091 × 201.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only. Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.

Affected

ProductAffectedFixed inSource
Linux2a359e072596fcb2e9e85017a865e3618a2fe5b5 – < ea7a76d7d614b5f82b4d0785f9af3550e860a71aea7a76d7d614b5f82b4d0785f9af3550e860a71aCNA
Linux2a359e072596fcb2e9e85017a865e3618a2fe5b5 – < 0a5dd8cf4d58ea28da132c2097cd1c525302ac480a5dd8cf4d58ea28da132c2097cd1c525302ac48CNA
Linux2a359e072596fcb2e9e85017a865e3618a2fe5b5 – < bb645aa0a4caeaf7f9cd32e9a948594d434c1a8fbb645aa0a4caeaf7f9cd32e9a948594d434c1a8fCNA
Linux6.166.18.40CNA

Scores by source

Linux (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refgit.kernel.org/stable/c/ea7a76d7d614b5f82b4d0785f9af3550e860a71arefgit.kernel.org/stable/c/0a5dd8cf4d58ea28da132c2097cd1c525302ac48refgit.kernel.org/stable/c/bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f