Skip to main content

Linux Kernel EUVDEUVD-2026-49606

| CVE-2026-64555 HIGH
2026-07-27 Linux GHSA-mh5j-7pgc-m97g
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Guest control gives PR:L/AV:L; the NV+MOPS+single-step precondition is non-default and hard to hit, so AC:H; host state corruption crosses scope (S:C) with DoS most likely (A:H) and limited C/I.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 30, 2026 - 06:55 vuln.today
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.8 (HIGH)
Patch available
Jul 27, 2026 - 21:17 EUVD
CVE Published
Jul 27, 2026 - 20:10 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 20:10 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()

kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writing the result directly into hardware.

In the case of nested virtualization, vcpu_cpsr() is a synthetic value such that the rest of KVM can deal with vEL2 cleanly. That means the value requires translation before being written into hardware, which is unfortunately missing from the MOPS handler.

Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state altogether, which will be resynchronized on the next 'full' exit back to KVM.

AnalysisAI

Guest-to-host state corruption in the Linux kernel's arm64 KVM nested-virtualization (NV) support arises because kvm_hyp_handle_mops() writes an untranslated synthetic CPSR value directly into hardware when rewinding single-step state after a MOPS (FEAT_MOPS memory copy/set) exception. On systems running a nested guest at virtual EL2, this bypasses the vEL2-to-hardware translation, leaving SPSR_EL2 with an invalid exception-return state that the host later consumes. The fix modifies SPSR_EL2 directly and defers resynchronization to the next full exit. There is no public exploit identified at time of analysis; EPSS is very low (0.17%, 6th percentile) and it is not in CISA KEV.

Technical ContextAI

The vulnerable code is in KVM's arm64 hypervisor fast path (kvm_hyp_handle_mops) that services exceptions generated by FEAT_MOPS instructions (CPYP/SETP-family memory move/set operations introduced in Armv8.8). To rewind the interrupted instruction, KVM resets the debug single-step state machine by adjusting the vCPU's CPSR. Under nested virtualization, KVM presents a *synthetic* vcpu_cpsr() so the rest of KVM can reason about a virtual EL2 (vEL2) guest hypervisor cleanly; that synthetic value must be translated back into real hardware register layout (SPSR_EL2) before being loaded. The MOPS handler omitted this translation, so a raw synthetic value reached hardware. CPE data identifies the affected product only generically as cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel; the root-cause class is improper state restoration / incorrect handling of exceptional conditions in the nested-virt exception path (no CWE was assigned in the input).

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc4 (fix commits https://git.kernel.org/stable/c/10a568010e827108d149779908850afaec898846, https://git.kernel.org/stable/c/884b44256041ec6b2dcbe8e6a67384d26145cba1, https://git.kernel.org/stable/c/dd3b237eb7780d65eae296d3d3a70012b6e7a02f, https://git.kernel.org/stable/c/ff1022c3de46753eb7eba2f6efd990569e66ff95); apply your distribution's corresponding backport. If patching must be deferred, the most effective compensating control is to not expose nested virtualization to untrusted guests: on arm64 KVM leave nested virt disabled (do not set the NV capability / avoid kvm-arm.mode or per-VM nested-virt enablement), which fully removes the vEL2 code path at the cost of denying guests the ability to run their own hypervisors. Restricting the ability to create/administer arm64 guests to trusted operators also limits exposure. These controls only matter on Arm systems with KVM; x86 hosts are unaffected. Track advisories via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-64555.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-49606 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy