CVE-2026-72278

In CVE-2026-72278, the Linux kernel KVM for arm64 mitigates a VNCR abort handling issue by invalidating the VNCR TLB and re-fetching the translation when a VNCR abort occurs. This allows the host mapping to be faulted in for write on the second attempt, addressing a scenario where a guest could r...

EUVD-2026-59177

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...

CVE-2026-72277

Summary (CVE-2026-72277): In the Linux kernel’s KVM for arm64, the L1 VNCR mapping logic now rejects non-memory PFNs when constructing VNCR mappings, due to unconditional use of cacheable memory attributes that could trigger an SError on writeback. The vulnerability affected KVM’s handling of VNC...

CVE-2026-72277 KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

EUVD-2026-59176

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

CVE-2026-72277 KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

PT-2026-72467

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

PT-2026-72466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gue...

PT-2026-72465

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

CVE-2026-64288

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...

CVE-2026-64288 KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...

CVE-2026-64288 KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...

CVE-2026-64282 KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvmtranslatevncr races MMU notifier In the case that kvmtranslatevncr races with an MMU notifier the early return does not release a reference on the faulted in PFN. Add the necessary call to...

PT-2026-64503

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvm translate vncr races MMU notifier In the case that kvm translate vncr races with an MMU notifier the early return does not release a reference on the faulted in PFN. Add the necessary call to k...

Linux Distros Unpatched Vulnerability : CVE-2026-64288

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcp...