CVE-2026-80665 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
kvm_handle_vncr_abort() assumes that s1_walk_result conveys an abort when kvm_translate_vncr() returns -EFAULT. This is not always the case as it's possible to encounter 'late' failures on the output of S1 translation, e.g. a GFN outside of the memslots.
Fix it by preparing an external abort before returning from kvm_translate_vncr(). Get rid of the BUG_ON() in the fault injection path while at it.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel's KVM subsystem for ARM64 architectures contains a critical logic flaw within its nested virtualization translation mechanism, specifically affecting how page faults are handled during stage one address translations. The vulnerability centers on the kvm_translate_vncr function and its interaction with the kvm_handle_vncr_abort handler. In this context, when a guest operating system attempts to translate a virtual non-contiguous range of addresses, the hypervisor must resolve these mappings by walking through page tables. The existing implementation incorrectly assumes that if kvm_translate_vncr returns an -EFAULT error code, it invariably signifies a translation abort condition that should be injected into the nested guest as a synchronous external abort (SEA). This assumption fails to account for late-stage failures where the physical frame number derived from the translation process falls outside the defined memory slots of the virtual machine. Such scenarios typically arise when the guest accesses memory regions that have not been properly mapped or allocated within the host's memslot structure, leading to a mismatch between the error code returned and the actual nature of the fault condition.
This misclassification of errors leads to significant operational instability for nested virtualization workloads. When kvm_handle_vncr_abort receives an -EFAULT result from a late-stage translation failure rather than a true abort scenario, it may incorrectly inject an SEA into the guest or mishandle the exception state. This can cause the nested guest kernel to panic unexpectedly due to receiving an inappropriate fault type for the underlying memory access violation. Furthermore, the presence of a BUG_ON macro in the fault injection path indicates that under certain unhandled conditions, the system could trigger a kernel panic on the host side, effectively causing a denial of service against all virtual machines running on that physical hardware. The lack of proper error propagation means that transient or boundary-related memory access issues are not gracefully handled but instead result in catastrophic failures for both the nested guest and potentially the hypervisor itself.
From a security and standards perspective, this vulnerability aligns with CWE-253, which describes incorrect check of return value, as the code fails to properly validate whether an error condition represents a fatal abort or a recoverable translation failure. It also relates to CWE-787, out-of-bounds write access in terms of memory management logic, since accessing GFNs outside memslots violates expected memory boundaries defined by the virtualization layer. In terms of MITRE ATT&CK techniques, this flaw impacts Availability and could be exploited for Denial of Service against nested VMs if an attacker with control over guest kernel behavior can trigger specific translation sequences that expose these late-stage failures. The vulnerability highlights a gap in robust error handling within complex hypervisor code paths where multiple layers of address translation occur simultaneously.
To mitigate this risk, the fix involves modifying kvm_translate_vncr to explicitly prepare and return an external abort condition when it detects conditions such as GFNs outside memslots, rather than relying on ambiguous -EFAULT returns that are misinterpreted by higher-level handlers. This ensures that the fault injection path correctly identifies translation failures versus true aborts. Additionally, removing the BUG_ON macro from the fault injection path prevents kernel panics during error handling sequences, allowing for more graceful degradation or proper exception propagation instead of immediate system halts. Administrators should ensure their Linux kernels are updated to include this patch and verify that nested virtualization configurations do not rely on potentially unstable memory mappings. Regular auditing of KVM configuration parameters and monitoring guest logs for unexpected aborts can help detect residual issues in environments where full kernel updates may be delayed.