kvm_vcpu_init_nested Heap Buffer Overflow DoS

The vulnerability of the kvmvcpuinitnested function in the arch/arm64/kvm/nested.c module of the virtualization subsystem on the 64-bit ARM-based Linux operating system is related to the copying of buffers without checking input data. Exploiting this vulnerability could allow an attacker to...

SUSE CVE-2026-72280

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context, as it is expected if FEATNV2 is advertised to the L1 hypervisor. Get rid of th...

SUSE CVE-2026-72287

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks Move the off-by-default consistency check for vmcs12.tprthreshold vs. the virtual APIC vTPR into the "normal" controls checks, as waiting until KVM has...

CVE-2026-80699

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component for ARM64 architectures. This vulnerability, specifically affecting AmpereOne processors, occurs when a physical interrupt is double-deactivated in a nested virtualization context. An attacker could potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-80665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes...

SUSE CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

SUSE CVE-2026-80699

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit a...

CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

UBUNTU-CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80699

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit a...

CVE-2026-80665 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

EUVD-2026-67541

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80665

This vulnerability affects the Linux kernel's KVM arm64 nested virtualization subsystem. The root cause is in kvm_handle_vncr_abort() , which incorrectly assumes that a -EFAULT return from kvm_translate_vncr() always conveys an abort. In practice, "late" failures on S1 translation output (e.g., a...

CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-64562

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nested virtualization nVMX feature. This vulnerability occurs because the shadow Virtual Machine Control Structure VMCS is freed prematurely while still being referenced. Due to asynchronous operations, a virtual CPU vCPU mig...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: removed the spurious WARN message when writing to ZCREL2. It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context. This is expected if FEATNV2 is advertised to the L1...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: KVM: nVMX: Moving the consistency check between vTPR and TPR Threshold to “normal” checks Moving the off-by-default consistency check for vmcs12.tprthreshold versus the virtual APIC vTPR to the “normal” control checks is...

CVE-2026-74516

A flaw was found in KVM Kernel-based Virtual Machine. When the Advanced Virtual Interrupt Controller AVIC is inhibited while a nested guest L2 is active, KVM fails to properly update x2APIC MSR intercepts for the primary guest L1. This allows the L1 guest to read the host's APIC state, send...

SUSE CVE-2026-72278

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...