What is the CVSS score of EUVD-2026-59176?

EUVD-2026-59176 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by EUVD-2026-59176?

A critical denial-of-service vulnerability in Linux arm64 KVM nested-virtualization support allows guest virtual machines to crash the host by exploiting improper memory attribute handling.. A patch is available.

How to fix or mitigate EUVD-2026-59176?

Within 24 hours, inventory all Linux systems running KVM virtualization on arm64 architecture and assess their criticality. Within 7 days, consult your Linux distribution's security advisory and kernel vendor for the patched version, validate it in pre-production environments, and develop a staged rollout plan coordinating with stakeholders for necessary reboots. Within 30 days, deploy the patched kernel across all production arm64-based KVM systems, prioritizing critical infrastructure, with thorough validation after each rollout phase.

Linux Kernel EUVD-2026-59176

| CVE-2026-72277 CRITICAL

2026-08-15 Linux

GHSA-x8qc-pvh3-2vf6

Linux Code Injection Red Hat Suse

Critical

Disputed · 9.3 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

5.6 MEDIUM

Local arm64 NV path requiring a controllable guest (PR:L) and a non-default non-memory backing (AC:H); impact is host SError/DoS with scope change, so A:H and C:N/I:N.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:03 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.3 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:54 cve.org

CRITICAL 9.3

CVE Published

Aug 15, 2026 - 05:54 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory

When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the endpoint doesn't support cacheable memory attributes, potentially throwing an SError on writeback...

While KVM does permit cacheable memory attributes on certain PFNMAP VMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the simpler thing for now and just reject everything that isn't memory.

AnalysisAI

Denial-of-service in the Linux kernel's arm64 KVM nested-virtualization (NV) support allows an L1 guest to trigger a host System Error (SError) by pointing its VNCR mapping at a non-memory PFN. Because kvm_translate_vncr() unconditionally applies cacheable memory attributes without checking whether the backing PFN is real memory, a writeback to a device/non-cacheable endpoint can raise an uncontained SError on the host. The upstream fix makes KVM reject non-memory backing and inject a Synchronous External Abort (SEA) into the guest instead. There is no public exploit identified at time of analysis and EPSS is low (0.21%).

Technical ContextAI

The issue lives in KVM on arm64 nested virtualization, a feature that lets a KVM guest itself run guests (L1/L2). VNCR (Virtual Nested Control Register) is the mechanism the ARMv8.4 NV extension uses to memory-map a guest's system-register backing page so the hypervisor can trap and shadow nested register state. When KVM constructs the L1 VNCR mapping in kvm_translate_vncr(), it hardcodes cacheable (Normal/WB) memory attributes for the stage-2 mapping regardless of the underlying page frame. If the PFN actually backs a device or otherwise non-cacheable region (an endpoint that does not support cacheable accesses), a cache writeback to that address can generate an SError on the host. KVM does allow cacheable attributes for certain PFNMAP VMAs, but the function does not currently fetch the VMA to distinguish those cases, so the interim fix simply rejects anything that is not normal memory. CPE data lists cpe:2.3:a:linux:linux and the CWE is unassigned (N/A), though the behavior is consistent with an improper memory-attribute/type-confusion root cause.

RemediationAI

Vendor-released patch: update to a fixed Linux kernel - 6.18.40 or later on the 6.18 stable series, 7.1.5 or later, or 7.2-rc4/7.2 for mainline - or apply the backported stable commits d5436e18e4fc, bc00e0e376ee, and 4bd7dbe0b224 (https://git.kernel.org/stable/c/d5436e18e4fc2886ac306304d884ea3b92e1edbf and the two companion commits), then rebuild and reboot. Where immediate patching is not possible, the most effective compensating control is to disable arm64 KVM nested virtualization (do not set kvm-arm.mode/nested to enable NV, or run guests without the nested capability), which fully removes the vulnerable VNCR translation path at the cost of losing nested-VM functionality. Additionally restrict which tenants can launch guests on affected arm64 hosts, since exploitation requires a controllable L1 guest; this limits exposure without a code change but does not fix the underlying flaw. Track vendor rebuilds via your distribution's advisory feed and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-72277.

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-59176 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59176

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Code Injection

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code