Linux Kernel EUVD-2026-39291

Vendor-released patch: Linux 7.0.13 and 7.1 - upgrade affected arm64 KVM hosts to one of these (or later) stable kernels, the primary and recommended fix. The corrective change manipulates the correct XN bit instead of misusing FIELD_PREP() on the already-extracted value; it is available upstream via commits 49b32ddb87a3a109afecea89e55d70f73956b8bc and b95976c2ea446044553a5f469c0bae13553d75ab (https://git.kernel.org/stable/c/49b32ddb87a3a109afecea89e55d70f73956b8bc, https://git.kernel.org/stable/c/b95976c2ea446044553a5f469c0bae13553d75ab). If immediate patching is not possible, the most effective compensating control is to disable KVM nested virtualization on arm64 hosts (e.g., do not enable the NV feature for guests), which fully removes the vulnerable path at the cost of losing nested-hypervisor capability for tenants; alternatively, restrict which guests run on affected !FEAT_XNX hardware by scheduling sensitive nested-virt workloads onto CPUs that implement FEAT_XNX, accepting the operational overhead of hardware-aware placement. Track distribution backports for your specific kernel branch, since the fix is a small targeted patch likely to be picked into other stable trees.