What is the CVSS score of CVE-2026-72280?

CVE-2026-72280 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel KVM are affected by CVE-2026-72280?

A denial-of-service vulnerability in Linux KVM's arm64 nested virtualization allows guest hypervisors to crash the host, directly impacting availability of cloud infrastructure or environments using…. A patch is available.

How to fix or mitigate CVE-2026-72280?

Within 24 hours, identify all production arm64 Linux systems running KVM with nested virtualization enabled and confirm whether FEAT_NV2 nesting to guest hypervisors is actively in use, as only these configurations are affected. Within 7 days, obtain the vendor-released kernel patch and deploy it to test environments, validating kernel stability and application compatibility before production rollout. Within 30 days, complete patch deployment to all affected production arm64 hypervisor hosts and implement kernel logging to detect attempts to trigger the vulnerable ZCR_EL2 register path as a monitoring baseline.

Linux Kernel KVM CVE-2026-72280

EUVD-2026-59179 HIGH

2026-08-15 Linux

GHSA-pjc6-4q26-frjf

Information Disclosure Linux Red Hat Suse

7.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

5.6 MEDIUM

Requires non-default FEAT_NV2 nested virt config (AC:H) and guest hypervisor role (PR:L); hyp_panic escapes guest boundary (S:C), availability-only impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:05 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.1 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

HIGH 7.1

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2

It is entirely possible for a guest to write to the ZCR_EL2 sysreg alias while in a nested context, as it is expected if FEAT_NV2 is advertised to the L1 hypervisor.

Get rid of the bogus WARN which, since the hyp vectors were installed at this point, has the effect of a hyp_panic...

AnalysisAI

Denial of service in the Linux kernel's KVM arm64 nested virtualization subsystem allows a guest to crash the host hypervisor by writing to the ZCR_EL2 system register alias during a nested context. Affected systems run arm64 Linux kernel builds where FEAT_NV2 is advertised to an L1 guest hypervisor; the write is architecturally legitimate in this context, but a misplaced WARN triggers a hyp_panic, taking down the KVM hypervisor layer. No public exploit or CISA KEV listing exists, and EPSS probability sits at 0.21% (11th percentile), reflecting low observed exploitation activity.

Technical ContextAI

ZCR_EL2 is the ARM Scalable Vector Extension (SVE) control register at Exception Level 2. In ARM nested virtualization (FEAT_NV2), when a first-level (L1) guest hypervisor is running, a second-level (L2) guest may legitimately write to the ZCR_EL2 sysreg alias as part of normal SVE state management. The Linux kernel KVM implementation (arm64 NV code path) contained a WARN assertion that incorrectly treated this write as invalid. Because KVM installs hypervisor vectors (hyp vectors) before this code path is reached, the WARN does not merely log a kernel message - it instead precipitates a hyp_panic, a fatal crash at EL2 that brings down the KVM hypervisor. The CWE is not formally assigned, but this maps most closely to an incorrect assertion / improper input validation in a privileged code path (CWE-617 or CWE-20). The CPE strings identify the Linux kernel broadly (cpe:2.3:a:linux:linux:*) without architecture restriction, but exploitation is confined to arm64 KVM nested virtualization deployments.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.12.97 or later for the 6.12 branch, 6.18.40 or later for the 6.18 branch, 7.1.5 or later for the 7.1 branch, or 7.2-rc4 or later for the 7.2 development series. Patch commits are available at https://git.kernel.org/stable/c/5000bcae71c869cba6674c326fec2d8ad659ae3a (6.12), https://git.kernel.org/stable/c/7deadbc5dab5b8e2316364603bc6281129c8461c (6.18), https://git.kernel.org/stable/c/9f1667098c6ae7ec81a9a56859cfdacb822aa0d0 (7.1), and https://git.kernel.org/stable/c/6561597dba97e3e8479a9919bda172cf43eb902c (7.2-rc4). As a compensating control prior to patching, disabling FEAT_NV2 advertisement to guest hypervisors (by not exposing nested virtualization capabilities to L1 VMs in the KVM configuration) eliminates the trigger condition entirely; this trade-off prevents L1 guests from acting as hypervisors but fully mitigates the panic path. Standard kernel live-patching mechanisms (kpatch, kGraft) may be applicable depending on distribution support.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72280 vulnerability details – vuln.today

Back

Linux Kernel KVM CVE-2026-72280

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code