Linux Kernel CVE-2026-80665

Exploitation requires all of the following conditions to be simultaneously true: (1) ARM64 hardware running a vulnerable Linux kernel with KVM enabled; (2) KVM nested virtualization explicitly enabled on the host - a non-default configuration not present in standard cloud or bare-metal Linux deployments; (3) an attacker with root or equivalent access inside a guest VM, sufficient to configure and launch a nested (L2) guest using the nested virtualization capability; and (4) the ability to arrange the nested guest's memory layout such that a VNCR page access resolves via Stage 1 translation to a GFN outside the host's configured KVM memory slots - an edge-case condition requiring deliberate control over nested guest memory configuration. x86/AMD64 KVM, ARM64 hosts without nested virtualization enabled, and all non-KVM hypervisors are entirely unaffected regardless of Linux kernel version.

The NVD CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H yields a 7.1 score with changed scope and high availability impact, reflecting a host kernel panic as the worst-case outcome. However, real-world risk is substantially narrowed by exploitation prerequisites: the host must be ARM64, KVM must be active, and nested virtualization must be explicitly enabled - a non-default configuration absent in most production Linux deployments. The EPSS score of 0.18% (7th percentile) corroborates this narrow exposure. No CISA KEV listing exists and no public exploit code has been identified. The PR:N in the NVD vector is from the host's perspective (a guest is unprivileged relative to the host kernel), but within the guest, operating a nested hypervisor typically requires root-level access, making practical exploitation dependent on a compromised or malicious privileged guest. This is a low-urgency patch for most organizations but high-priority for ARM64 cloud providers or environments running nested VMs (e.g., CI/CD pipelines). The scope change (S:C) accurately reflects that a guest-triggered condition can crash the entire host kernel, terminating all co-resident VMs - a meaningful tenant-isolation concern in multi-tenant ARM64 deployments despite the low EPSS.

An attacker with root access inside an ARM64 KVM guest VM, on a host where nested virtualization is enabled, configures a nested (L2) guest whose memory layout causes a VNCR page access to resolve via Stage 1 translation to a GFN outside the host's KVM memory slots. This triggers the flawed -EFAULT return path in kvm_translate_vncr(), where the caller either fires the now-removed BUG_ON() causing a host kernel panic or injects a malformed abort, terminating all co-resident VMs. No public exploit code exists for this scenario at time of analysis.