CVE-2026-72280 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2
It is entirely possible for a guest to write to the ZCR_EL2 sysreg alias while in a nested context, as it is expected if FEAT_NV2 is advertised to the L1 hypervisor.
Get rid of the bogus WARN which, since the hyp vectors were installed at this point, has the effect of a hyp_panic...
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's KVM implementation specifically targeting arm64 architecture virtualization environments. The issue stems from an incorrect warning mechanism that triggers when a guest operating system attempts to write to the ZCR_EL2 system register alias during nested virtualization contexts. The ZCR_EL2 register serves as a control register for the SVE (Scalable Vector Extension) functionality within ARM architecture, and its proper handling is critical for maintaining virtualization integrity. When FEAT_NV2 (Nested Virtualization version 2) is advertised to the Level 1 hypervisor, guest operating systems legitimately need to access this register during nested execution scenarios.
The technical flaw manifests as a spurious warning condition that was implemented without proper consideration of legitimate nested virtualization use cases. This warning mechanism, which should have been conditional on specific error states, instead activates whenever any write operation occurs to the ZCR_EL2 register during nested contexts. Since the hypervisor vectors have already been installed and configured by this point in the execution flow, this erroneous warning condition effectively results in a system panic rather than allowing normal execution to continue. The warning mechanism was designed to catch potential issues but failed to account for the legitimate scenarios where such writes should be permitted under proper nested virtualization protocols.
The operational impact of this vulnerability is significant within virtualized environments that utilize ARM64 architecture with nested virtualization capabilities. Systems running with FEAT_NV2 support, particularly those hosting multiple levels of virtual machines, could experience unexpected system panics when guest operating systems perform legitimate write operations to the ZCR_EL2 register. This disruption would cause immediate system instability and potential data loss within affected virtual environments. The vulnerability essentially creates a false positive condition that prevents normal operation of nested virtualization features while maintaining the appearance of system protection.
The fix addresses this by removing the problematic warning mechanism entirely, allowing legitimate guest operations to proceed without triggering system panics. This change aligns with proper virtualization implementation practices where legitimate register access patterns during nested execution should be permitted rather than flagged as errors. The solution follows established principles of hypervisor design that distinguish between actual error conditions and normal operational behaviors within virtualized environments.
This vulnerability relates to several cybersecurity concepts including improper handling of system register access in virtualized environments, which can be categorized under CWE-248 (Uncaught Exception) and CWE-754 (Improper Check for Unusual or Exceptional Conditions). The issue also connects to ATT&CK techniques involving privilege escalation through hypervisor manipulation and system instability exploitation. From a cybersecurity maturity perspective, this represents a failure in proper virtualization state management where legitimate operations were incorrectly classified as error conditions, highlighting the importance of thorough testing across all supported virtualization scenarios including nested execution environments that are increasingly common in modern cloud computing deployments.