GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72279 (GCVE-0-2026-72279)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backing PFN is read-only (e.g. RO memslot), meaning that the L1 VNCR should use at most a read-only mapping. Cache the writability of the PFN in the VNCR TLB and use it to constrain the resulting fixmap permissions. Promote VNCR permission faults to an SEA in the case where the guest attempts to write to a read-only endpoint. Conveniently, this also plugs a page leak found by Sashiko [*] resulting from the early return for a read-only PFN.
Severity
9 (Critical)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2a359e072596fcb2e9e85017a865e3618a2fe5b5 , < 5c50db5bcbb9073cb2fd97be51b962de92f429e9 (git)
Affected: 2a359e072596fcb2e9e85017a865e3618a2fe5b5 , < d35defbdfcb15296ebe28968ad7452c1a8c11cea (git)
Affected: 2a359e072596fcb2e9e85017a865e3618a2fe5b5 , < 2684e02bac41c5220f6c1ab2bdcc957b71812977 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c50db5bcbb9073cb2fd97be51b962de92f429e9",
              "status": "affected",
              "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5",
              "versionType": "git"
            },
            {
              "lessThan": "d35defbdfcb15296ebe28968ad7452c1a8c11cea",
              "status": "affected",
              "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5",
              "versionType": "git"
            },
            {
              "lessThan": "2684e02bac41c5220f6c1ab2bdcc957b71812977",
              "status": "affected",
              "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR\n\nKVM currently maps the L1 VNCR into the host stage-1 by relying entirely\non the permissions of the guest stage-1. At the same time, it is\nentirely possible that the backing PFN is read-only (e.g. RO memslot),\nmeaning that the L1 VNCR should use at most a read-only mapping.\n\nCache the writability of the PFN in the VNCR TLB and use it to constrain\nthe resulting fixmap permissions. Promote VNCR permission faults to an\nSEA in the case where the guest attempts to write to a read-only\nendpoint. Conveniently, this also plugs a page leak found by Sashiko [*]\nresulting from the early return for a read-only PFN."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only when a nested arm64 KVM guest hypervisor triggers VNCR_EL2 data aborts handled via KVM_RUN through kvm_handle_vncr_abort() and kvm_translate_vncr(); no network, adjacent-radio, or physical-device path reaches this code.\nAC:L - An attacker controlling an L1 nested-hypervisor VM can reliably configure VNCR_EL2, guest stage-1 page tables, and KVM_MEM_READONLY memslots, then trigger translation faults and writes; nested virt on arm64 cloud hosts is an attacker-selectable deployment, not an uncontrollable condition.\nPR:N - Exploitation requires no host root or init-namespace capabilities beyond running code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM guest CVE scoring.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR faults, fixmap remapping, and repeated write triggers are fully attacker-driven from within the guest.\nS:C - The bug defeats host KVM enforcement of read-only memslots via host fixmap mappings and leaks host kernel page references on the error path, crossing the guest-to-hypervisor security boundary by affecting host memory accounting and VMM-imposed memory protections beyond the guest authority.\nC:N - The vulnerability provides a write and page-reference leak primitive, not an out-of-bounds read, use-after-free, or other information-disclosure path; corrupted RO guest pages are attacker-influenced backing store, not arbitrary host kernel memory reads.\nI:H - Mapping an RO-backed PFN into the host fixmap with PAGE_KERNEL lets a guest hypervisor write to memory the VMM marked KVM_MEM_READONLY, bypassing a host-enforced integrity control and enabling modification of protected guest or hypervisor pages such as firmware, virtio metadata, or EL2 state.\nA:H - Repeated write faults to read-only VNCR endpoints leak a faulted-in page reference on each early -EFAULT return without kvm_release_faultin_page(), enabling sustained host kernel memory exhaustion and denial of service to co-resident workloads on the hypervisor."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:14.902Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c50db5bcbb9073cb2fd97be51b962de92f429e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d35defbdfcb15296ebe28968ad7452c1a8c11cea"
        },
        {
          "url": "https://git.kernel.org/stable/c/2684e02bac41c5220f6c1ab2bdcc957b71812977"
        }
      ],
      "title": "KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72279",
    "datePublished": "2026-08-15T05:55:04.313Z",
    "dateReserved": "2026-08-09T03:40:39.916Z",
    "dateUpdated": "2026-08-17T05:42:14.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72279",
      "date": "2026-09-05",
      "epss": "0.00189",
      "percentile": "0.08539"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72279\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:58.077\",\"lastModified\":\"2026-08-17T06:18:30.473\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR\\n\\nKVM currently maps the L1 VNCR into the host stage-1 by relying entirely\\non the permissions of the guest stage-1. At the same time, it is\\nentirely possible that the backing PFN is read-only (e.g. RO memslot),\\nmeaning that the L1 VNCR should use at most a read-only mapping.\\n\\nCache the writability of the PFN in the VNCR TLB and use it to constrain\\nthe resulting fixmap permissions. Promote VNCR permission faults to an\\nSEA in the case where the guest attempts to write to a read-only\\nendpoint. Conveniently, this also plugs a page leak found by Sashiko [*]\\nresulting from the early return for a read-only PFN.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/kvm/nested.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2a359e072596fcb2e9e85017a865e3618a2fe5b5\",\"lessThan\":\"5c50db5bcbb9073cb2fd97be51b962de92f429e9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a359e072596fcb2e9e85017a865e3618a2fe5b5\",\"lessThan\":\"d35defbdfcb15296ebe28968ad7452c1a8c11cea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a359e072596fcb2e9e85017a865e3618a2fe5b5\",\"lessThan\":\"2684e02bac41c5220f6c1ab2bdcc957b71812977\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/kvm/nested.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H\",\"baseScore\":9.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.8}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2684e02bac41c5220f6c1ab2bdcc957b71812977\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5c50db5bcbb9073cb2fd97be51b962de92f429e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d35defbdfcb15296ebe28968ad7452c1a8c11cea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T18:55:36+00:00",
      "cve": "CVE-2026-72279",
      "id": "CVE-2026-72279",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72279.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.