CVE-2026-72278

CriticalCVSS 9.3/10Last modified Aug 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Re-translate VNCR before injecting abort

KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only.

Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 2a359e072596fcb2e9e85017a865e3618a2fe5b5, < ea7a76d7d614b5f82b4d0785f9af3550e860a71a; >= 2a359e072596fcb2e9e85017a865e3618a2fe5b5, < 0a5dd8cf4d58ea28da132c2097cd1c525302ac48; >= 2a359e072596fcb2e9e85017a865e3618a2fe5b5, < bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f
LinuxLinux6.16

References

Timeline

Published
Aug 15, 2026
Last modified
Aug 17, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-722799.0In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currentCVE-2026-72287.3A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get_cart_count of the file /adminCVE-2026-722807.1In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 It is entirely poCVE-2026-72281In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: account pKVM reclaim against the VM mm Protected guest fauCVE-2026-722827.8In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers kvmCVE-2026-722838.8In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails NuCVE-2026-722847.1In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs CVE-2026-722857.8In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDXCVE-2026-722868.8In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The iCVE-2026-722877.8In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" CVE-2026-722889.3In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPICVE-2026-722899.3In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it
CVE-2026-72278: Critical severity, CVSS 9.3 | Vulnix