CVE-2026-72278
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Re-translate VNCR before injecting abort
KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only.
Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 2a359e072596fcb2e9e85017a865e3618a2fe5b5 < ea7a76d7d614b5f82b4d0785f9af3550e860a71a | affected |
| Linux | Linux | 2a359e072596fcb2e9e85017a865e3618a2fe5b5 < 0a5dd8cf4d58ea28da132c2097cd1c525302ac48 | affected |
| Linux | Linux | 2a359e072596fcb2e9e85017a865e3618a2fe5b5 < bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f | affected |
| Linux | Linux | 6.16 | affected |
| Linux | Linux | 0 < 6.16 | unaffected |
| Linux | Linux | 6.18.40 <= 6.18.* | unaffected |
| Linux | Linux | 7.1.5 <= 7.1.* | unaffected |
| Linux | Linux | 7.2 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/ea7a76d7d614b5f82b4d0785f9af3550e860a71a
- https://git.kernel.org/stable/c/0a5dd8cf4d58ea28da132c2097cd1c525302ac48
- https://git.kernel.org/stable/c/bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.