CVE-2026-72279

A flaw was found in the KVM (Kernel-based Virtual Machine) component of the Linux kernel. KVM on arm64 architectures incorrectly maps the L1 Virtual Nested Control Register (VNCR) into the host stage-1, failing to respect read-only memory regions. This could allow a malicious guest to write to a protected memory area, resulting in a page leak and potential information disclosure.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires a local authenticated user inside an ARM64 guest running on a host with nested virtualization support enabled. The issue stems from an improper permission check when mapping virtual nested control registers for read-only memory slots, which could allow a guest to write to restricted memory or trigger a host page leak leading to denial of service. Deployments on older enterprise releases and non-ARM64 architectures do not support or include this nested virtualization code path and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.