What is the CVSS score of CVE-2026-72279?

CVE-2026-72279 has a contested CVSS base score of 9.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72279?

A critical vulnerability in Linux kernel versions 6.16-6.18.39 and 7.0-7.1.4 allows attackers with hypervisor access to compromise host system memory, threatening data security in cloud and…. A patch is available.

How to fix or mitigate CVE-2026-72279?

Within 24 hours, identify all systems running Linux kernel 6.16 through 6.18.39 or 7.0.x-7.1.4 with KVM nested virtualization enabled by checking kernel versions and reviewing hypervisor configurations. Within 7 days, apply vendor patches to upgrade to Linux kernel 6.18.40 or 7.1.5 or newer depending on the current release line; coordinate with infrastructure teams to schedule maintenance windows for affected cloud platforms and virtualization hosts. Within 30 days, validate patch deployment across all affected inventory, audit system logs for exploitation indicators, and confirm operational stability following updates.

Linux Kernel CVE-2026-72279

EUVD-2026-59178 CRITICAL

2026-08-15 Linux

GHSA-3627-jjwg-8vfw

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.0 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.0 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

vuln.today AI

7.5 HIGH

Attacker must control an L1 guest (PR:L) on a non-default arm64 NV host and arrange a read-only-backed VNCR endpoint (AC:H); guest-to-host scope change (S:C) with integrity write and host DoS, no disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:04 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.0 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

CRITICAL 9.0

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR

KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backing PFN is read-only (e.g. RO memslot), meaning that the L1 VNCR should use at most a read-only mapping.

Cache the writability of the PFN in the VNCR TLB and use it to constrain the resulting fixmap permissions. Promote VNCR permission faults to an SEA in the case where the guest attempts to write to a read-only endpoint. Conveniently, this also plugs a page leak found by Sashiko [*] resulting from the early return for a read-only PFN.

AnalysisAI

Improper permission handling in the KVM ARM64 nested-virtualization (NV) subsystem of the Linux kernel (6.16 through fixes in 6.18.40/7.1.5) lets a malicious L1 guest hypervisor write to a read-only backing page and trigger a page reference leak on the host. When mapping the L1 VNCR page into the host stage-1, KVM trusted only the guest stage-1 permissions and ignored that the backing PFN may be read-only (e.g. a read-only memslot), permitting writes to memory that should be immutable and leaking pages on the read-only early-return path. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV.

Technical ContextAI

The flaw is in KVM's implementation of ARMv8.4+ FEAT_NV2 nested virtualization on arm64. VNCR (Virtual Nested Control Register) is the mechanism by which a nested (L1) hypervisor's EL2 system-register accesses are redirected to an in-memory page that KVM maps into the host stage-1 via the fixmap. The bug: KVM derived the fixmap mapping permissions solely from the guest stage-1 translation and never consulted the writability of the actual host PFN, so a read-only PFN (such as one backed by a read-only memslot) could be mapped writable. The fix caches the PFN writability in the VNCR TLB and constrains the fixmap permission accordingly, and promotes a VNCR permission fault to an SEA (Synchronous External Abort) when the guest writes a read-only endpoint. The same corrected path also closes a page-refcount leak that occurred on the early return for read-only PFNs. CWE is unassigned by NVD, but the root cause is a class of improper permission enforcement combined with a resource (page reference) leak.

RemediationAI

Vendor-released patch: update to a fixed stable kernel, 6.18.40 or 7.1.5 (mainline 7.2-rc4), or apply the backported stable commits (5c50db5bcbb9073cb2fd97be51b962de92f429e9, d35defbdfcb15296ebe28968ad7452c1a8c11cea, 2684e02bac41c5220f6c1ab2bdcc957b71812977) from https://git.kernel.org/stable/. Because the vulnerable path is only reachable when arm64 KVM nested virtualization is enabled, an effective compensating control if you cannot patch immediately is to disable nested virtualization for KVM guests on arm64 hosts (do not expose FEAT_NV2 to guests / avoid the kvm-arm NV configuration), which removes the attack surface entirely at the cost of losing nested-hypervisor capability for tenants that rely on it. Restricting who may launch guests with NV enabled and treating L1 guests as untrusted with strict memslot handling further reduces exposure. Reference the commit links above for exact code and the NVD entry for tracking.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72279 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72279

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code