CVE-2026-72280

HighCVSS 7.1/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2

It is entirely possible for a guest to write to the ZCR_EL2 sysreg alias while in a nested context, as it is expected if FEAT_NV2 is advertised to the L1 hypervisor.

Get rid of the bogus WARN which, since the hyp vectors were installed at this point, has the effect of a hyp_panic...

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f, < 6561597dba97e3e8479a9919bda172cf43eb902c; >= 0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f, < 5000bcae71c869cba6674c326fec2d8ad659ae3a; >= 0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f, < 7deadbc5dab5b8e2316364603bc6281129c8461c; >= 0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f, < 9f1667098c6ae7ec81a9a56859cfdacb822aa0d0
LinuxLinux6.11

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-72281In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: account pKVM reclaim against the VM mm Protected guest fauCVE-2026-722827.8In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers kvmCVE-2026-722838.8In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails NuCVE-2026-722847.1In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs CVE-2026-722857.8In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDXCVE-2026-722868.8In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The iCVE-2026-722877.8In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" CVE-2026-722889.3In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPICVE-2026-722899.3In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating itCVE-2026-72296.3A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file /cims/modules/admin/CVE-2026-72290In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvm_s390_CVE-2026-722919.3In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix unlikely race in try_get_locked_pte() Fix an unlikely r
CVE-2026-72280: High severity, CVSS 7.1 | Vulnix