CVE-2026-53200 KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
A flaw in Linux kernel KVM arm64 nested virtualization incorrectly grants execute permissions, potentially allowing privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53200?
CVE-2026-53200 is a high-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
XN has already been extracted from its bitfield position so using FIELD_PREP() on the mask that clears XN[0] is completely broken, having the effect of unconditionally granting execute permissions...
Fix the obvious mistake by manipulating the right bit.
Which versions are affected by CVE-2026-53200?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53200?
Apply the vendor's patch.
Is CVE-2026-53200 being exploited?
There is no known exploitation of CVE-2026-53200 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-53200, GHSA-9vgc-pr94-c63x, UBUNTU-CVE-2026-53200.