CVE-2026-72281 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: account pKVM reclaim against the VM mm
Protected guest faults charge long term pins to the VM's mm. Teardown can run later from file release, where current->mm may be unrelated.
Drop the charge from kvm->mm instead.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides within the Linux kernel's KVM (Kernel-based Virtual Machine) implementation specifically targeting the arm64 architecture. The issue involves improper memory accounting during virtual machine teardown operations, creating a potential resource management flaw that could lead to incorrect memory tracking and allocation behavior. The problem manifests when protected guest faults occur and charge long term pins to the VM's memory management structure, but the subsequent teardown process executes from file release contexts where the current process memory management context may be entirely unrelated to the virtual machine in question.
The technical flaw stems from a mismatch in memory accounting semantics during KVM virtual machine lifecycle operations. When protected guest faults occur, they properly charge long term pins to the VM's memory management structure, but the teardown procedure that follows runs in a different execution context where current->mm references may not align with the target VM's memory management domain. This disconnect creates an improper memory accounting scenario where charges are applied to incorrect memory management structures, potentially leading to resource exhaustion or incorrect memory allocation decisions.
The operational impact of this vulnerability extends beyond simple memory accounting errors to potentially compromise system stability and resource utilization patterns within virtualized environments. Virtual machine administrators may experience unexpected memory pressure scenarios, incorrect resource allocation reporting, and potential denial of service conditions when multiple virtual machines operate concurrently with protected guest features enabled. The vulnerability particularly affects systems running arm64 architecture with KVM virtualization enabled and active protected guest configurations.
This issue relates to CWE-1287 which addresses improper resource charging in memory management contexts, and aligns with ATT&CK technique T1490 related to resource hijacking through improper memory accounting. The fix implemented involves changing the memory accounting mechanism from using kvm->mm for charge operations to dropping charges from the specific VM's memory management structure instead of relying on potentially unrelated current->mm references during teardown operations.
The mitigation strategy requires updating the KVM implementation to maintain proper memory accounting boundaries between virtual machine contexts and their associated memory management structures. This change ensures that memory charges related to protected guest fault handling are correctly attributed to the appropriate VM memory management domain regardless of execution context during teardown operations. System administrators should ensure kernel updates are applied that contain this specific memory accounting fix to prevent potential resource management issues in virtualized environments.
The vulnerability demonstrates a classic example of improper context management in kernel-level virtualization code where execution contexts change between different phases of operation but the underlying resource accounting assumptions remain static. This type of flaw commonly occurs in complex kernel subsystems where multiple execution paths must maintain consistent state and resource tracking across potentially unrelated memory management domains, particularly in virtualization environments where resource boundaries must be carefully maintained to ensure proper isolation and accounting.