CVE-2026-72277

Received Received - Intake

KVM: arm64 NV Memory Attribute Handling Issue

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the endpoint doesn't support cacheable memory attributes, potentially throwing an SError on writeback... While KVM does permit cacheable memory attributes on certain PFNMAP VMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the simpler thing for now and just reject everything that isn't memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72277

EUVD

EUVD-2026-59176

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects KVM for arm64 systems. It involves improper handling of memory attributes when creating L1 VNCR mappings. The issue occurs because KVM uses cacheable memory attributes by default, even when the underlying physical page isn't regular memory. This can lead to system errors like SError if the hardware doesn't support cacheable attributes.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 systems. Detection requires checking kernel logs for SError exceptions related to VNCR mappings or cacheable memory attributes. No standard commands exist for direct detection as it involves low-level hardware interactions.

Impact Analysis

This vulnerability could cause system instability or crashes on arm64 systems running virtual machines with KVM. It may lead to unexpected errors during virtual machine operations, particularly when handling memory mappings. Systems using non-cacheable memory attributes could experience severe failures like SError exceptions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to memory handling in KVM for arm64 systems. No evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. Monitor vendor advisories for arm64 KVM updates. If using affected systems, avoid enabling cacheable memory attributes on non-memory PFNs until patched.

Hi! I’m here to help you understand CVE-2026-72277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70