CVE-2026-72277

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached only when an arm64 nested-KVM L1 hypervisor triggers VNCR_EL2 data aborts (ESR_ELx_EC_DABT_CUR with ESR_ELx_VNCR) during KVM_RUN, handled via kvm_handle_vncr_abort(); no network, adjacent-radio, or physical-device path reaches this code.

AC:LAttack complexity, low

An attacker controlling an L1 nested-hypervisor VM can set VNCR_EL2 and guest EL2 page tables to point VNCR at non-RAM guest physical addresses (e.g. VFIO/MMIO passthrough) and reliably trigger VNCR translation faults; nested virt on arm64 cloud hosts is an attacker-selectable deployment, not an uncontrollable condition.

PR:NPrivileges required, none

Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.

UI:NUser interaction, none

No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR faults, page-table configuration, and fixmap establishment are fully attacker-driven from within the guest.

S:CScope, changed

Guest-controlled VNCR_EL2 mappings cause host KVM to create per-CPU EL2 fixmap aliases with cacheable kernel attributes to attacker-chosen non-RAM physical pages, crossing the guest-to-hypervisor security boundary and impacting host kernel integrity and availability beyond the guest's intended authority.

C:HConfidentiality impact, high

Before the fix, kvm_map_l1_vncr() mapped non-memory PFNs via __set_fixmap() with PAGE_KERNEL/PAGE_KERNEL_RO, letting the host hypervisor read attacker-selected physical addresses (device/MMIO or other non-RAM PFNs) through kernel virtual addresses during VNCR register emulation, providing an information-disclosure primitive across the isolation boundary.

I:HIntegrity impact, high

The same writable cacheable fixmap mapping gives the host kernel write access to attacker-chosen non-RAM physical pages; combined with incorrect cacheable attributes on endpoints that reject them, this can corrupt device/MMIO state and trigger uncontained host SErrors, constituting arbitrary physical write impact beyond guest scope.

A:HAvailability impact, high

Mapping non-memory PFNs with cacheable attributes can provoke Synchronous External Abort/SError on cache maintenance or writeback; on arm64 these commonly escalate to arm64_serror_panic()/nmi_panic(), crashing the host and denying service to all co-resident VMs and workloads.