What is the CVSS score of CVE-2026-72277?

CVE-2026-72277 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72277?

A critical denial-of-service vulnerability in Linux arm64 KVM nested-virtualization support allows guest virtual machines to crash the host by exploiting improper memory attribute handling.. A patch is available.

How to fix or mitigate CVE-2026-72277?

Within 24 hours, inventory all Linux systems running KVM virtualization on arm64 architecture and assess their criticality. Within 7 days, consult your Linux distribution's security advisory and kernel vendor for the patched version, validate it in pre-production environments, and develop a staged rollout plan coordinating with stakeholders for necessary reboots. Within 30 days, deploy the patched kernel across all production arm64-based KVM systems, prioritizing critical infrastructure, with thorough validation after each rollout phase.

Linux Kernel CVE-2026-72277

EUVD-2026-59176 CRITICAL

2026-08-15 Linux

GHSA-x8qc-pvh3-2vf6

Code Injection Linux Red Hat Suse

Critical

Disputed · 9.3 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

5.6 MEDIUM

Local arm64 NV path requiring a controllable guest (PR:L) and a non-default non-memory backing (AC:H); impact is host SError/DoS with scope change, so A:H and C:N/I:N.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:03 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.3 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:54 cve.org

CRITICAL 9.3

CVE Published

Aug 15, 2026 - 05:54 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory

When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the endpoint doesn't support cacheable memory attributes, potentially throwing an SError on writeback...

While KVM does permit cacheable memory attributes on certain PFNMAP VMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the simpler thing for now and just reject everything that isn't memory.

AnalysisAI

Denial-of-service in the Linux kernel's arm64 KVM nested-virtualization (NV) support allows an L1 guest to trigger a host System Error (SError) by pointing its VNCR mapping at a non-memory PFN. Because kvm_translate_vncr() unconditionally applies cacheable memory attributes without checking whether the backing PFN is real memory, a writeback to a device/non-cacheable endpoint can raise an uncontained SError on the host. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an arm64 host with KVM nested virtualization (NV) enabled and the attacker able to run and control an L1 guest that can steer its VNCR mapping to a page frame that is not normal system memory (e.g., a device/non-cacheable endpoint that rejects cacheable accesses). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals point to a low-to-moderate real-world priority despite the headline CVSS 9.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: update to a fixed Linux kernel - 6.18.40 or later on the 6.18 stable series, 7.1.5 or later, or 7.2-rc4/7.2 for mainline - or apply the backported stable commits d5436e18e4fc, bc00e0e376ee, and 4bd7dbe0b224 (https://git.kernel.org/stable/c/d5436e18e4fc2886ac306304d884ea3b92e1edbf and the two companion commits), then rebuild and reboot. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux systems running KVM virtualization on arm64 architecture and assess their criticality. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72277 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72277

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Code Injection

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code