EUVD-2026-80515
GHSA-crqv-c33h-f779
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Local guest vCPU access (AV:L, PR:L), missed invalidation is opportunistic/timing-dependent to weaponize (AC:H), L1→L0 crossing (S:C); DoS-dominant with bounded stale-TLB leak/corruption (C:L/I:L/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Remove VM-wide VNCR mapping counter
The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing with a TLB invalidation. It is incremented when a mapping is made in the fixmap, and decremented when unmapped.
As it turns out, this tracking has several flaws:
- we are trying to invalidate TLBs, and the mapping is only an
opportunistic consequence of the TLB. Checking this counter to decide whether a TLB needs to be invalidated may result in missed invalidations.
- an L1 vcpu invalidating its own TLB (a very likely case) will not
succeed in invalidating the VNCR pseudo TLB because that page is not mapped in L0 at this stage.
Given that this tracking fails at delivering the minimum guarantees that are required and is only a performance optimisation, remove it completely.
AnalysisAI
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations for an L1-supplied VNCR page in L0, allowing a guest with control of an L1 vCPU on an arm64 host to cross the guest-to-host boundary in a timing-sensitive way. Affected systems are those running kernel 6.16 or later with arm64 nested virtualization (FEAT_NV2 / VNCR page support) enabled and exposed to a guest; the flaw is a guest-to-host (L1-to-L0) issue, so exploitation requires guest-vCPU privileges and is local to the host, which contradicts the vendor's PR:N vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an arm64 host with KVM nested virtualization enabled (FEAT_NV2 / VNCR page support, kernel 6.16+) AND the attacker controlling a running L1 guest that can issue TLB invalidations - this is a guest-to-host (L1-to-L0) boundary crossing, so exploitation is local to the host and requires guest-vCPU privileges, contradicting the vendor's PR:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.18.52, 7.2.5, or 7.3-rc1 (or a later release containing the corresponding fix), or backport the upstream stable commits 5453b85c7ebb605febac3df42021f9471663f051, 87c2bbf189829dce4aaada8f82e3d54ccc037976, and c55bc773b6e814406658fae7dc5c15f639ed816e, which remove the VM-wide VNCR mapping counter and restore unconditional TLB invalidation semantics; the change is small and correctness-restoring, with the only expected side effect being a modest increase in TLB flush work on nested setups. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all arm64 KVM hosts running Linux kernel 6.16 or later and determine whether nested virtualization (FEAT_NV2/VNCR page support) is enabled and exposed to any guest; where nested virtualization is not required, disable it or restrict untrusted guest access as an immediate precaution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary host file exfiltration from Cloud Hypervisor VMM versions 34.0-50.0. CVSS 10.0. Patch available.
Incorrect handling of queued local TLB flushes in the Linux kernel's KVM nested-VMX (nVMX) implementation can leave stal
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed f
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range
A use-after-free (CWE-416) in the Linux kernel's s390/vfio-ap AP crypto passthrough driver allows a local attacker with
The s390 vfio-ap mediated device (mdev) driver in the Linux kernel fails to actually revoke crypto control-domain access
Stale hardware access to unplugged crypto resources in Linux KVM guests on IBM Z (s390) stems from a logic error in the
Stale TLB entries can be reused by an L2 guest in the Linux kernel's KVM nested virtualization (nVMX) implementation on
Linux kernel's KVM nested-VMX (nVMX) emulation can leave stale L2 guest TLB entries on a physical CPU, because KVM execu
Slab use-after-free in the Linux kernel's KVM x86 MMU lockless rmap aging path affects hosts running Linux 6.15 through
A use-after-free race in the arm64 KVM vGICv3 code path of the Linux kernel (vgic_v3_save_pending_tables) allows a local
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today