CVE-2026-72278

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for arm64 systems. This vulnerability occurs when a guest operating system attempts to access the Virtualization Nested Control Register (VNCR) page. If the guest reads from VNCR before writing to it, KVM may incorrectly handle the memory access, potentially leading to unexpected behavior or instability within the virtualized environment.

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) arm64 nested virtualization support. Red Hat Product Security has rated this flaw as having LOW impact. When a guest exercises nested virtualization on arm64 and accesses the Virtual Nested Control Register (VNCR) page, KVM faults the page in for write when the guest aborts for a write. If the guest reads the VNCR page before writing to it, the underlying page frame may only be mapped read-only; on a subsequent write abort, KVM does not invalidate the VNCR TLB and re-fetch the translation, so the mapping is not faulted in for write and an incorrect abort may be injected into the nested guest. A local attacker with control of a guest capable of exercising nested virtualization on an affected arm64 host could use this flaw to cause denial of service or instability within the nested virtualized environment; the available evidence indicates an availability impact only, with no demonstrated confidentiality or integrity impact, memory corruption, or host privilege escalation. Red Hat Enterprise Linux 10 (kernel in rhel-10.2.z and rhel-10.3) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm in rhivos-2.0.z, rhivos-2.0.z-core, rhivos-2.1, and rhivos-2.1-core) are affected because the introducing change is present in those streams; all other Red Hat Enterprise Linux kernel and kernel-rt streams, including rhel-10.0.z, are not affected because the vulnerable code is not present. Because of the low security impact, the fix is currently deferred for the affected streams; the residual risk is limited to denial of service against nested guests on arm64 hosts that use nested virtualization. Red Hat's severity assessment (CVSS 5.5, Moderate, LOW impact) differs significantly from the CVE.org score of 9.3 (Critical) because the upstream score assumes no privileges are required and high confidentiality and integrity impacts with a scope change, whereas Red Hat's analysis finds that this flaw requires local access to a guest capable of exercising nested virtualization and results only in loss of availability for the nested guest.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.