What is the CVSS score of CVE-2026-72286?

CVE-2026-72286 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72286?

A Linux kernel vulnerability in encrypted virtualization environments could expose sensitive data during virtual machine migration or maintenance operations.. A patch is available.

How to fix or mitigate CVE-2026-72286?

Within 24 hours, inventory all Linux systems running kernel versions 6.1 or later on AMD-based hypervisors with SEV-SNP capability, documenting active virtual machine migration or mirroring workloads. By day 7, begin staged patching to kernel versions 6.12.97, 6.18.40, 7.1.5, or 7.2-rc4 or later depending on your kernel branch, prioritizing systems with active VM migration. Complete migration to patched kernel versions across all affected hosts within 30 days.

Linux Kernel CVE-2026-72286

EUVD-2026-59185 HIGH

2026-08-15 Linux

GHSA-ghw4-q5h4-h5hf

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Triggering KVM intra-host SNP migration requires hypervisor management access and a running SEV-SNP VM, justifying PR:H and AC:H over the official PR:L/AC:L.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

6.6 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:10 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

HIGH 8.8

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs

The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as guest_req_mutex, guest_req_buf, and guest_resp_buf to be transferred or initialized on the destination.

The SNP VM mirroring requires vmsa features to be copied as well otherwise ASID would be bound to SNP range while VM is detected as a SEV VM.

Reject SNP source VMs in migration/mirroring until proper SNP state transfer is implemented.

[sean: let lines poke past 80 chars, tag for stable]

AnalysisAI

Incomplete SEV-SNP state handling in the Linux kernel's KVM subsystem breaks AMD Secure Encrypted Virtualization isolation when intra-host VM migration or mirroring is attempted on SNP guests, potentially exposing encrypted guest memory to confidentiality and integrity breaches. The vulnerability affects multiple stable kernel branches from commit 1dfe571c12cf99244b933208fb77f29471ded677 onward, with fixes backported to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code exists at time of analysis, and the EPSS score of 0.21% at the 11th percentile places real-world exploitation probability as very low despite the high official CVSS score of 8.8.

Technical ContextAI

The vulnerability resides in the KVM (Kernel-based Virtual Machine) hypervisor subsystem of the Linux kernel, specifically in the SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) implementation. SEV-SNP is AMD's hardware confidential computing technology that encrypts VM memory and enforces per-page access control through Reverse Map Tables; each guest is bound to a hardware ASID (Address Space Identifier) via its VMSA (Virtual Machine Save Area). The affected CPE is cpe:2.3:a:linux:linux:* across multiple stable branches. The defect has two related dimensions: during intra-host migration, three critical per-VM state structures - guest_req_mutex, guest_req_buf, and guest_resp_buf, which mediate SNP guest firmware requests - are neither transferred to nor freshly initialized on the destination, leaving SNP request handling in an undefined state; during mirroring, VMSA feature flags are not propagated, causing the ASID to remain bound to the SNP range while the VM is misclassified as a standard SEV (non-SNP) VM. No CWE identifier was assigned in the input data; the root cause class most closely matches CWE-908 (Use of Uninitialized Resource) combined with an incomplete implementation of a security-critical subsystem feature.

RemediationAI

The primary fix is to upgrade to a patched kernel version: 6.12.97 via commit b70404b89daad5f9f33f7ac640b1065cba639935 (https://git.kernel.org/stable/c/b70404b89daad5f9f33f7ac640b1065cba639935), 6.18.40 via commit ba06690b28be950bd46d938d9b919c4024292627 (https://git.kernel.org/stable/c/ba06690b28be950bd46d938d9b919c4024292627), 7.1.5 via commit d2f9df3b615ca0cd45899c090366945528186052 (https://git.kernel.org/stable/c/d2f9df3b615ca0cd45899c090366945528186052), or 7.2-rc4 and later via commit 6ee4140788234a6fabf59e6a50e38cdb936008cd (https://git.kernel.org/stable/c/6ee4140788234a6fabf59e6a50e38cdb936008cd). For environments where immediate kernel updates are not feasible, a compensating control is to prohibit intra-host KVM migration and mirroring for SEV-SNP VMs at the orchestration layer - for example, removing QEMU migration capabilities from VM definitions, restricting libvirt migration APIs via ACLs, or applying SELinux or AppArmor policy to block the relevant KVM migration ioctls; note that these controls must be enforced at the management plane and cannot substitute for patching, as they depend on the security of the orchestration layer itself. SEV-SNP VMs should not be migrated via the intra-host path until the kernel patch is applied.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72286 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72286

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code