AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-72277

UNKNOWN · CVSS N/A

Source: NVD + CISA KEV + EPSS · Published 2026-08-15 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's KVM module, specifically in the handling of memory attributes for guest VNCR mappings. If exploited, this flaw could lead to system errors, such as SError on writeback, by allowing the use of cacheable memory attributes on non-memory physical frame numbers (PFNs). Organizations utilizing KVM on arm64 architectures should prioritize addressing this issue to prevent potential system instability and ensure proper memory management.

CVE
CVE-2026-72277
Severity
UNKNOWN
CVSS
N/A
EPSS
N/A
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the endpoint doesn't support cacheable memory attributes, potentially throwing an SError on writeback... While KVM does permit cacheable memory attributes on certain PFNMAP VMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the simpler thing for now and just reject everything that isn't memory.