CVE-2026-72278

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is reached only when an arm64 nested-KVM L1 hypervisor triggers VNCR_EL2 data aborts (ESR_ELx_EC_DABT_CUR with ESR_ELx_VNCR) handled via KVM_RUN through kvm_handle_vncr_abort(); no network, adjacent-radio, or physical-device path reaches this code.

AC:LAttack complexity, low

An attacker controlling an L1 nested-hypervisor VM can reliably issue read-then-write VNCR accesses, remap the VNCR page, and force translation/permission faults; nested virt on arm64 cloud hosts is an attacker-selectable deployment, not an uncontrollable condition.

PR:NPrivileges required, none

Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.

UI:NUser interaction, none

No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR faults, pseudo-TLB reuse, and repeated write triggers are fully attacker-driven from within the guest.

S:CScope, changed

Stale VNCR pseudo-TLB and fixmap state lets guest-controlled faults cause host KVM to map and access the wrong guest physical pages when emulating EL2 register state, crossing the guest-to-hypervisor security boundary beyond the guest's intended authority.

C:HConfidentiality impact, high

Reusing a cached VNCR translation without re-walking guest page tables can make the host read unintended guest physical pages through the per-CPU fixmap during VNCR emulation, providing a stale-translation information-disclosure primitive across guest memory views.

I:HIntegrity impact, high

Without re-translation on write aborts, a writable host fixmap established under a stale read-only fault can let the hypervisor write nested EL2 register values into the wrong guest physical page, corrupting memory the VMM expected to isolate.

A:HAvailability impact, high

Incorrect permission/external-abort injection on VNCR write faults after a prior read leaves nested hypervisors unable to progress and can drive tight host-side fault-handling loops, causing CPU exhaustion and denial of service to co-resident workloads.