What is the CVSS score of CVE-2026-72278?

CVE-2026-72278 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72278?

A memory corruption vulnerability in Linux KVM's arm64 nested virtualization component (CVE-2026-72278, CVSS 9.3) could allow guest VMs to corrupt the hypervisor's kernel memory, potentially…. A patch is available.

How to fix or mitigate CVE-2026-72278?

Within 24 hours, conduct an inventory of all arm64-based Linux hypervisors with nested virtualization enabled (check `/sys/module/kvm/parameters/nested` on each host) and document their criticality and workload dependencies. Within 7 days, obtain and test the Linux kernel patch from your distribution's security advisory in a non-production environment to validate compatibility with your nested VM workloads. Within 30 days, execute patching across all affected hypervisors according to your change management procedures, prioritizing production infrastructure, and validate that nested virtualization functionality and workloads remain operational post-patch.

Linux Kernel CVE-2026-72278

EUVD-2026-59177 CRITICAL

2026-08-15 Linux

GHSA-8rrh-94xj-vxx2

Linux Code Injection Red Hat Suse

Critical

Disputed · 9.3 Vendor: Linux

Severity by source

Sources disagree (Low–Critical)

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local trigger requires running an arm64 nested guest (PR:L) and a specific read-before-write race (AC:H); a successful escape crosses the guest/host boundary (S:C) with full host impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:03 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.3 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:54 cve.org

CRITICAL 9.3

CVE Published

Aug 15, 2026 - 05:54 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Re-translate VNCR before injecting abort

KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only.

Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.

AnalysisAI

Guest-to-host memory corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) path arises from mishandling of the VNCR page translation: when a nested guest reads the VNCR page before writing, the host maps the PFN read-only and fails to re-fetch a writable translation on the subsequent write abort. The fix invalidates the VNCR TLB and re-translates before injecting the abort, restoring correct write-fault handling and satisfying FEAT_ETS2/3 ordering. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and it is not on CISA KEV.

Technical ContextAI

The affected component is KVM for arm64 with nested virtualization (the 'nv' subsystem), specifically the VNCR (Virtual Nested Control Register) mechanism used to accelerate register access for a guest hypervisor running its own guests. When a nested guest faults on the VNCR page, KVM faults the page in similar to a stage-2 mapping; using FOLL_WRITE only on write aborts means a prior read can leave a read-only PFN cached, so a later write is not correctly serviced. The CWE is listed as N/A, but the class is best understood as improper handling of a page-fault/translation state (a memory-management ordering defect) rather than classic memory-safety corruption; the tags label it 'Code Injection,' which appears to be an automated tag rather than a confirmed exploit primitive. CPE data is generic (cpe:2.3:a:linux:linux:*), so exact affected builds must be derived from the stable-tree commits.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.18.40 or later on the 6.18 line, 7.1.5 or later on the 7.1 line, or mainline 7.2-rc4 and later; apply your distribution's backported kernel carrying stable commits ea7a76d7, 0a5dd8cf, or bb645aa0 (https://git.kernel.org/stable/c/ea7a76d7d614b5f82b4d0785f9af3550e860a71a). Because the defect is reachable only through arm64 KVM nested virtualization, the most effective compensating control until patching is to disable nested virtualization for arm64 guests (do not expose NV / do not set the KVM NV capability for tenant VMs), which fully removes the trigger at the cost of denying nested-hypervisor workloads. Where NV must remain enabled, restrict who can launch nested guests to trusted operators, since untrusted tenants able to run their own hypervisor are the only actors positioned to hit the VNCR abort path.

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72278 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72278

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Code Injection

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code