Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
kvm_handle_vncr_abort() assumes that s1_walk_result conveys an abort when kvm_translate_vncr() returns -EFAULT. This is not always the case as it's possible to encounter 'late' failures on the output of S1 translation, e.g. a GFN outside of the memslots.
Fix it by preparing an external abort before returning from kvm_translate_vncr(). Get rid of the BUG_ON() in the fault injection path while at it.
Metrics
CVSS 3.1 7.1/10
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HAffected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 2a359e072596fcb2e9e85017a865e3618a2fe5b5, < 4ead4def04659739c399bfcb063f8a906194c79f; >= 2a359e072596fcb2e9e85017a865e3618a2fe5b5, < 53804b6839573c9c6fff5f4cf075d6746267345e; >= 2a359e072596fcb2e9e85017a865e3618a2fe5b5, < 9f3e83345a56280efffe235c65593c7e544c0fcc |
| Linux | Linux | 6.16 |
References
Timeline
- Published
- Aug 28, 2026
- Last modified
- Aug 29, 2026
- NVD status
- Received