CVE-2026-53200

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64 architectures. This vulnerability arises from incorrect handling of the Execute Never (XN) bit, a memory protection feature, when the FEAT_XNX feature is not enabled. This error can lead to execute permissions being unconditionally granted, potentially allowing a local attacker to execute arbitrary code with elevated privileges.

This vulnerability is rated as having Moderate impact because exploitation requires local access within an ARM64 nested virtualization environment lacking FEAT_XNX support, significantly restricting the affected scenario to specialized deployment conditions. In these specific setups, flawed evaluation of stage-2 memory translation flags allows pages marked non-executable to become executable within nested guest contexts. Typical Red Hat Enterprise Linux host workloads and environments that do not host nested ARM64 virtual machines remain unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.