CVE-2026-72277 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the endpoint doesn't support cacheable memory attributes, potentially throwing an SError on writeback...
While KVM does permit cacheable memory attributes on certain PFNMAP VMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the simpler thing for now and just reject everything that isn't memory.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's KVM implementation specifically targeting arm64 architecture virtualization environments. The issue manifests in how KVM handles L1 VNCR (Virtual Nested Control Register) mappings when constructing memory mappings for guest virtual machines. The flaw stems from an improper assumption that all page frame numbers can utilize cacheable memory attributes regardless of their actual underlying nature.
The technical implementation problem occurs within the kvm_translate_vncr() function which unconditionally applies cacheable memory attributes during L1 VNCR mapping construction. This approach fails to properly inspect or validate the underlying page frame number characteristics before applying memory attribute settings. When the endpoint hardware lacks support for cacheable memory attributes, this unconditional application can trigger system-level SError exceptions during writeback operations, effectively causing virtual machine instability or system crashes.
The operational impact of this vulnerability extends beyond simple performance degradation to potential system instability and guest VM compromise. Virtual machines running on affected systems may experience unexpected termination or system-wide errors when attempting memory operations that trigger the SError condition. The vulnerability particularly affects arm64 systems where cacheable memory attribute support varies across hardware implementations, creating an inconsistent behavior pattern that could be exploited by malicious actors to cause denial of service conditions.
This issue aligns with CWE-1236 which addresses improper neutralization of special elements used in resource identifiers and CWE-399 which covers resource management errors. From an attack perspective, this vulnerability maps to ATT&CK technique T1059.001 for command and script injection through kernel-level manipulation, and T1499.004 for network denial of service attacks targeting virtualization infrastructure. The fix implemented represents a defensive programming approach that rejects non-memory mappings rather than attempting complex attribute negotiation, which aligns with security principle of least privilege and fail-safe defaults.
Mitigation strategies should focus on updating to kernel versions containing the patched implementation where KVM properly validates VMA characteristics before applying memory attributes. System administrators should prioritize patch management for virtualization environments and monitor for any SError occurrences that might indicate this vulnerability's exploitation. The solution demonstrates proper input validation practices by ensuring only legitimate memory mappings receive cacheable attributes, thereby preventing the escalation of hardware-level errors into system-wide failures. Organizations relying on arm64 KVM virtualization should conduct thorough testing to verify the patch effectiveness and monitor system logs for any residual error conditions that might indicate incomplete remediation of related vulnerabilities in the virtualization stack.