CVE-2026-72277

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the endpoint doesn't support cacheable memory attributes, potentially throwing an SError on writeback... While KVM does permit cacheable memory attributes on certain PFNMAP VMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the simpler thing for now and just reject everything that isn't memory.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/4bd7dbe0b2243e6aa735cae4d5e1ff988b30b2a6
https://git.kernel.org/stable/c/bc00e0e376ee3572f5d26c174473abef1e35decc
https://git.kernel.org/stable/c/d5436e18e4fc2886ac306304d884ea3b92e1edbf

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 06:21

Updated : 2026-08-17 06:18

NVD link : CVE-2026-72277

Mitre link : CVE-2026-72277

CVE.ORG link : CVE-2026-72277

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-72277", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.5}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5", "lessThan": "d5436e18e4fc2886ac306304d884ea3b92e1edbf", "versionType": "git"}, {"status": "affected", "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5", "lessThan": "bc00e0e376ee3572f5d26c174473abef1e35decc", "versionType": "git"}, {"status": "affected", "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5", "lessThan": "4bd7dbe0b2243e6aa735cae4d5e1ff988b30b2a6", "versionType": "git"}], "programFiles": ["arch/arm64/kvm/nested.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/arm64/kvm/nested.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T06:21:57.750", "references": [{"url": "https://git.kernel.org/stable/c/4bd7dbe0b2243e6aa735cae4d5e1ff988b30b2a6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bc00e0e376ee3572f5d26c174473abef1e35decc", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d5436e18e4fc2886ac306304d884ea3b92e1edbf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory\n\nWhen constructing an L1 VNCR mapping, KVM unconditionally uses cacheable\nmemory attributes, even if the underlying PFN isn't memory. This gets\nparticularly hairy if the endpoint doesn't support cacheable memory\nattributes, potentially throwing an SError on writeback...\n\nWhile KVM does permit cacheable memory attributes on certain PFNMAP\nVMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the\nsimpler thing for now and just reject everything that isn't memory."}], "lastModified": "2026-08-17T06:18:30.240", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}