CVE-2026-72277

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) for ARM64 systems. When KVM constructs an L1 VNCR (Virtual Nested Control Register) mapping, it incorrectly applies cacheable memory attributes even when the underlying physical memory is not normal memory. This can lead to a system error (SError) during writeback operations, potentially causing system instability or a denial of service.

A moderate-impact flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) ARM64 nested virtualization support. This flaw affects Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2, where KVM, when constructing an L1 VNCR (Virtual Nested Control Register) mapping, unconditionally uses cacheable memory attributes even when the underlying physical page frame (PFN) is not normal memory. If the endpoint does not support cacheable memory attributes, this can raise a System Error (SError) on writeback, crashing the host kernel and causing a denial of service. Exploitation requires local access to a guest virtual machine capable of controlling nested virtualization state and its backing memory mappings; the issue is not network-reachable and affects availability only, with no impact on confidentiality or integrity. Red Hat Enterprise Linux 6, 7, 8, 9, and 10.0 streams are not affected because the vulnerable code, introduced upstream in Linux 6.16, is not present in those versions. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams the fix is currently deferred, so those systems carry the residual risk of a guest-triggered host crash (denial of service) until a fix is delivered. Red Hat rates this flaw as Moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVE record's Critical rating (9.3) because exploitation requires a local, privileged guest context and the impact is limited to denial of service with no confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.