CVE-2026-80665

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component for ARM64 architectures. The kvm_handle_vncr_abort() function incorrectly assumes that a specific translation result always indicates an abort, even when kvm_translate_vncr() returns an error for a Guest Frame Number (GFN) outside of allocated memory. This misinterpretation can lead to system instability or a denial of service (DoS) within the virtualized environment.

A denial of service vulnerability was found in the Linux kernel's KVM (Kernel-based Virtual Machine) ARM64 nested virtualization code. When kvm_translate_vncr() cannot resolve a page frame number -- for example when the translated Guest Frame Number (GFN) lies outside the configured memslots -- kvm_handle_vncr_abort() incorrectly assumes that the stage-1 walk result always describes an abort. On such 'late' translation failures this misinterpretation can lead the fault injection path to hit a BUG_ON(), crashing the kernel. A local user with access to KVM virtualization on an affected ARM64 host (for example through /dev/kvm, running or controlling a guest with nested virtualization) could use this flaw to crash the host kernel, causing a denial of service. Confidentiality and integrity are not affected. Red Hat rates this flaw as Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record rates it Important (CVSS 7.1, AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H); this difference reflects that triggering the issue requires local access with the ability to run or control a virtual machine through KVM, and that the impact is limited to availability. This issue affects the kernel in Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, and rhel-10.4 streams) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm components). Red Hat Enterprise Linux 6, 7, 8, and 9, as well as the RHEL 10.0 kernel and kernel-rt streams, are not affected because the vulnerable code is not present in those kernels. For the affected streams, the fix is deferred to a future product update; the residual risk until the fix is applied is that a local user able to run nested virtualization on an affected ARM64 system could crash the host, causing a denial of service for the workloads running on it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.