CVE-2026-72279
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backing PFN is read-only (e.g. RO memslot), meaning that the L1 VNCR should use at most a read-only mapping.
Cache the writability of the PFN in the VNCR TLB and use it to constrain the resulting fixmap permissions. Promote VNCR permission faults to an SEA in the case where the guest attempts to write to a read-only endpoint. Conveniently, this also plugs a page leak found by Sashiko [*]
resulting from the early return for a read-only PFN.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's KVM hypervisor implementation specifically targeting the arm64 architecture. The issue stems from how the virtual machine monitor handles memory mappings between guest and host stages, particularly concerning the L1 Virtual Nested Control Register (VNCR) management. When KVM maps L1 VNCR into the host stage-1 translation table, it currently disregards the actual permissions of the underlying physical frame number (PFN) backing the memory region.
The technical flaw manifests in the improper handling of read-only memory slots within the virtualization layer. The kernel's current implementation relies solely on guest stage-1 permissions without considering that the backing PFN might be marked as read-only, such as in read-only memory slots. This creates a security risk where malicious guests could potentially exploit the mismatch between reported permissions and actual physical memory characteristics. The vulnerability is categorized under CWE-284 Access Control and aligns with ATT&CK technique T1059 Command and Scripting Interpreter for privilege escalation scenarios.
The operational impact of this vulnerability allows for potential information disclosure and privilege escalation attacks within virtualized environments. When a guest attempts to write to a read-only memory region through the VNCR mapping, the system should properly handle this violation by promoting permission faults to a Software Exception Abort (SEA). However, the current implementation fails to enforce proper access controls, potentially enabling unauthorized writes to read-only memory regions. This issue particularly affects ARM64-based virtual machines running under KVM hypervisor where memory management policies are not consistently enforced across translation layers.
The fix implemented addresses this by caching the writability status of PFNs within the VNCR Translation Lookaside Buffer (TLB) and using this information to properly constrain the resulting fixmap permissions. This approach ensures that when a guest attempts to write to what should be read-only memory, the system correctly promotes the permission fault to an SEA rather than allowing the operation to proceed. The solution also resolves a page leak vulnerability identified by Sashiko, which occurred due to early returns for read-only PFNs without proper cleanup of allocated resources. This remediation strengthens the overall security posture of KVM virtualization environments by ensuring consistent memory access control enforcement between guest and host translation layers, preventing potential abuse of memory mapping inconsistencies that could compromise isolation properties of virtual machines.