Vulnerability-Lookup

FKIE_CVE-2026-72279

Vulnerability from fkie_nvd - Published: 2026-08-15 06:21 - Updated: 2026-08-17 06:18

Severity

9.0 (Critical) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backing PFN is read-only (e.g. RO memslot), meaning that the L1 VNCR should use at most a read-only mapping. Cache the writability of the PFN in the VNCR TLB and use it to constrain the resulting fixmap permissions. Promote VNCR permission faults to an SEA in the case where the guest attempts to write to a read-only endpoint. Conveniently, this also plugs a page leak found by Sashiko [*] resulting from the early return for a read-only PFN.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2684e02bac41c5220f6c1ab2bdcc957b71812977
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5c50db5bcbb9073cb2fd97be51b962de92f429e9
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d35defbdfcb15296ebe28968ad7452c1a8c11cea

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c50db5bcbb9073cb2fd97be51b962de92f429e9",
              "status": "affected",
              "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5",
              "versionType": "git"
            },
            {
              "lessThan": "d35defbdfcb15296ebe28968ad7452c1a8c11cea",
              "status": "affected",
              "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5",
              "versionType": "git"
            },
            {
              "lessThan": "2684e02bac41c5220f6c1ab2bdcc957b71812977",
              "status": "affected",
              "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR\n\nKVM currently maps the L1 VNCR into the host stage-1 by relying entirely\non the permissions of the guest stage-1. At the same time, it is\nentirely possible that the backing PFN is read-only (e.g. RO memslot),\nmeaning that the L1 VNCR should use at most a read-only mapping.\n\nCache the writability of the PFN in the VNCR TLB and use it to constrain\nthe resulting fixmap permissions. Promote VNCR permission faults to an\nSEA in the case where the guest attempts to write to a read-only\nendpoint. Conveniently, this also plugs a page leak found by Sashiko [*]\nresulting from the early return for a read-only PFN."
    }
  ],
  "id": "CVE-2026-72279",
  "lastModified": "2026-08-17T06:18:30.473",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.8,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-15T06:21:58.077",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2684e02bac41c5220f6c1ab2bdcc957b71812977"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5c50db5bcbb9073cb2fd97be51b962de92f429e9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d35defbdfcb15296ebe28968ad7452c1a8c11cea"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-72279 (GCVE-0-2026-72279)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42

Title

KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR

Summary

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/5c50db5bcbb9073cb…
https://git.kernel.org/stable/c/d35defbdfcb15296e…
https://git.kernel.org/stable/c/2684e02bac41c5220…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2a359e072596fcb2e9e85017a865e3618a2fe5b5 , < 5c50db5bcbb9073cb2fd97be51b962de92f429e9 (git) Affected: 2a359e072596fcb2e9e85017a865e3618a2fe5b5 , < d35defbdfcb15296ebe28968ad7452c1a8c11cea (git) Affected: 2a359e072596fcb2e9e85017a865e3618a2fe5b5 , < 2684e02bac41c5220f6c1ab2bdcc957b71812977 (git)
Linux	Linux	Affected: 6.16 Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c50db5bcbb9073cb2fd97be51b962de92f429e9",
              "status": "affected",
              "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5",
              "versionType": "git"
            },
            {
              "lessThan": "d35defbdfcb15296ebe28968ad7452c1a8c11cea",
              "status": "affected",
              "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5",
              "versionType": "git"
            },
            {
              "lessThan": "2684e02bac41c5220f6c1ab2bdcc957b71812977",
              "status": "affected",
              "version": "2a359e072596fcb2e9e85017a865e3618a2fe5b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/nested.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR\n\nKVM currently maps the L1 VNCR into the host stage-1 by relying entirely\non the permissions of the guest stage-1. At the same time, it is\nentirely possible that the backing PFN is read-only (e.g. RO memslot),\nmeaning that the L1 VNCR should use at most a read-only mapping.\n\nCache the writability of the PFN in the VNCR TLB and use it to constrain\nthe resulting fixmap permissions. Promote VNCR permission faults to an\nSEA in the case where the guest attempts to write to a read-only\nendpoint. Conveniently, this also plugs a page leak found by Sashiko [*]\nresulting from the early return for a read-only PFN."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only when a nested arm64 KVM guest hypervisor triggers VNCR_EL2 data aborts handled via KVM_RUN through kvm_handle_vncr_abort() and kvm_translate_vncr(); no network, adjacent-radio, or physical-device path reaches this code.\nAC:L - An attacker controlling an L1 nested-hypervisor VM can reliably configure VNCR_EL2, guest stage-1 page tables, and KVM_MEM_READONLY memslots, then trigger translation faults and writes; nested virt on arm64 cloud hosts is an attacker-selectable deployment, not an uncontrollable condition.\nPR:N - Exploitation requires no host root or init-namespace capabilities beyond running code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM guest CVE scoring.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR faults, fixmap remapping, and repeated write triggers are fully attacker-driven from within the guest.\nS:C - The bug defeats host KVM enforcement of read-only memslots via host fixmap mappings and leaks host kernel page references on the error path, crossing the guest-to-hypervisor security boundary by affecting host memory accounting and VMM-imposed memory protections beyond the guest authority.\nC:N - The vulnerability provides a write and page-reference leak primitive, not an out-of-bounds read, use-after-free, or other information-disclosure path; corrupted RO guest pages are attacker-influenced backing store, not arbitrary host kernel memory reads.\nI:H - Mapping an RO-backed PFN into the host fixmap with PAGE_KERNEL lets a guest hypervisor write to memory the VMM marked KVM_MEM_READONLY, bypassing a host-enforced integrity control and enabling modification of protected guest or hypervisor pages such as firmware, virtio metadata, or EL2 state.\nA:H - Repeated write faults to read-only VNCR endpoints leak a faulted-in page reference on each early -EFAULT return without kvm_release_faultin_page(), enabling sustained host kernel memory exhaustion and denial of service to co-resident workloads on the hypervisor."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:14.902Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c50db5bcbb9073cb2fd97be51b962de92f429e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d35defbdfcb15296ebe28968ad7452c1a8c11cea"
        },
        {
          "url": "https://git.kernel.org/stable/c/2684e02bac41c5220f6c1ab2bdcc957b71812977"
        }
      ],
      "title": "KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72279",
    "datePublished": "2026-08-15T05:55:04.313Z",
    "dateReserved": "2026-08-09T03:40:39.916Z",
    "dateUpdated": "2026-08-17T05:42:14.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-72279

CVE-2026-72279 (GCVE-0-2026-72279)

Tags

Sightings

Nomenclature