EUVD-2026-67541
GHSA-qpmv-4rfj-75x9
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Nested virtualization requires explicit non-default host configuration (AC:H) and root-level guest access to operate a nested hypervisor (PR:L); scope change reflects host kernel panic impacting all co-resident VMs.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
kvm_handle_vncr_abort() assumes that s1_walk_result conveys an abort when kvm_translate_vncr() returns -EFAULT. This is not always the case as it's possible to encounter 'late' failures on the output of S1 translation, e.g. a GFN outside of the memslots.
Fix it by preparing an external abort before returning from kvm_translate_vncr(). Get rid of the BUG_ON() in the fault injection path while at it.
AnalysisAI
Availability denial in the Linux kernel's KVM ARM64 nested virtualization stack allows a guest VM to crash the host through improper Synchronous External Abort (SEA) handling when Stage 1 translation resolves a Guest Frame Number outside configured memory slots. Affected systems must run a vulnerable Linux 6.16-era kernel on ARM64 hardware with KVM nested virtualization explicitly enabled; fixed versions are 6.18.40, 7.1.5, and 7.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be simultaneously true: (1) ARM64 hardware running a vulnerable Linux kernel with KVM enabled; (2) KVM nested virtualization explicitly enabled on the host - a non-default configuration not present in standard cloud or bare-metal Linux deployments; (3) an attacker with root or equivalent access inside a guest VM, sufficient to configure and launch a nested (L2) guest using the nested virtualization capability; and (4) the ability to arrange the nested guest's memory layout such that a VNCR page access resolves via Stage 1 translation to a GFN outside the host's configured KVM memory slots - an edge-case condition requiring deliberate control over nested guest memory configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H yields a 7.1 score with changed scope and high availability impact, reflecting a host kernel panic as the worst-case outcome. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Linux kernel to a patched stable release: 6.18.40, 7.1.5, or 7.2, referencing the kernel.org stable-branch patch commits (4ead4def, 53804b68, and 9f3e8334). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running Linux kernel versions 6.16-era on ARM64 hardware with KVM nested virtualization explicitly enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today