CVE-2026-72278 KVM: arm64: nv: Re-translate VNCR before injecting abort
A flaw in Linux KVM arm64 nested virtualization could cause incorrect memory translation handling, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72278?
CVE-2026-72278 is a critical vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Re-translate VNCR before injecting abort
KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only.
Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.
Which versions are affected by CVE-2026-72278?
How do I fix CVE-2026-72278?
Apply the vendor's patch.
Is CVE-2026-72278 being exploited?
There is no known exploitation of CVE-2026-72278 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72278, DEBIAN-CVE-2026-72278, GHSA-8rrh-94xj-vxx2, UBUNTU-CVE-2026-72278.