CVE-2026-72279

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is reached only when a nested arm64 KVM guest hypervisor triggers VNCR_EL2 data aborts handled via KVM_RUN through kvm_handle_vncr_abort() and kvm_translate_vncr(); no network, adjacent-radio, or physical-device path reaches this code.

AC:LAttack complexity, low

An attacker controlling an L1 nested-hypervisor VM can reliably configure VNCR_EL2, guest stage-1 page tables, and KVM_MEM_READONLY memslots, then trigger translation faults and writes; nested virt on arm64 cloud hosts is an attacker-selectable deployment, not an uncontrollable condition.

PR:NPrivileges required, none

Exploitation requires no host root or init-namespace capabilities beyond running code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM guest CVE scoring.

UI:NUser interaction, none

No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR faults, fixmap remapping, and repeated write triggers are fully attacker-driven from within the guest.

S:CScope, changed

The bug defeats host KVM enforcement of read-only memslots via host fixmap mappings and leaks host kernel page references on the error path, crossing the guest-to-hypervisor security boundary by affecting host memory accounting and VMM-imposed memory protections beyond the guest authority.

C:NConfidentiality impact, none

The vulnerability provides a write and page-reference leak primitive, not an out-of-bounds read, use-after-free, or other information-disclosure path; corrupted RO guest pages are attacker-influenced backing store, not arbitrary host kernel memory reads.

I:HIntegrity impact, high

Mapping an RO-backed PFN into the host fixmap with PAGE_KERNEL lets a guest hypervisor write to memory the VMM marked KVM_MEM_READONLY, bypassing a host-enforced integrity control and enabling modification of protected guest or hypervisor pages such as firmware, virtio metadata, or EL2 state.

A:HAvailability impact, high

Repeated write faults to read-only VNCR endpoints leak a faulted-in page reference on each early -EFAULT return without kvm_release_faultin_page(), enabling sustained host kernel memory exhaustion and denial of service to co-resident workloads on the hypervisor.