Strix
56.7K

CVE-2026-72278

CRITICALCVSS 9.3/10EPSS 0.21%

Last modified

CVE-2026-72278 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only. Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only. Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.

Metrics

CVSS 3.1
9.3/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Probability
0.21%

11.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 2a359e072596fcb2e9e85017a865e3618a2fe5b5, < ea7a76d7d614b5f82b4d0785f9af3550e860a71a; >= 2a359e072596fcb2e9e85017a865e3618a2fe5b5, < 0a5dd8cf4d58ea28da132c2097cd1c525302ac48; >= 2a359e072596fcb2e9e85017a865e3618a2fe5b5, < bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f
LinuxLinux6.16

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72278?
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only. Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.
How severe is CVE-2026-72278?
CVE-2026-72278 has a CVSS score of 9.3/10 (CRITICAL severity). The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72278?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72278?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST