In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Re-translate VNCR before injecting abort

KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts
for a write, similar to how a regular stage-2 mapping is handled. It is
entirely possible that the guest reads from the VNCR before writing to
it, in which case the PFN could only be read-only.

Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR
abort, allowing the host mapping to be faulted in for write the second
time around. Interestingly enough, this also satisfies the ordering
requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
2a359e072596fcb2e9e85017a865e3618a2fe5b5 affected < ea7a76d7d614b5f82b4d0785f9af3550e860a71a
2a359e072596fcb2e9e85017a865e3618a2fe5b5 affected < 0a5dd8cf4d58ea28da132c2097cd1c525302ac48
2a359e072596fcb2e9e85017a865e3618a2fe5b5 affected < bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f
Linux Linux affected
Version Status Constraints
6.16 affected —
0 unaffected < 6.16
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc4 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0a5dd8cf4d58ea28da132c2097cd1c525302ac48 cve-icon cve-icon
https://git.kernel.org/stable/c/bb645aa0a4caeaf7f9cd32e9a948594d434c1a8f cve-icon cve-icon
https://git.kernel.org/stable/c/ea7a76d7d614b5f82b4d0785f9af3550e860a71a cve-icon cve-icon
History

Sat, 15 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-787

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only. Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.
Title KVM: arm64: nv: Re-translate VNCR before injecting abort
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:54:59.698Z

Reserved: 2026-08-09T03:40:39.916Z

Link: CVE-2026-72278

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:57.927

Modified: 2026-08-15T06:21:57.927

Link: CVE-2026-72278

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T10:00:06Z

Weaknesses