CVE-2026-72278
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only. Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.
Affected versions
Linux kernel versions
6.16
and later are affected. Fixed in
6.18.40,
7.1.5,
7.2-rc4
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-72278?
CVE-2026-72278 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.16 onward and has been patched in 6.18.40, 7.1.5 and 7.2-rc4. CVE-2026-72278 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72278?
Yes. CVE-2026-72278 has been patched. Fixed versions include 6.18.40, 7.1.5 and 7.2-rc4. If you are running Linux kernel 6.16 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72278 actively exploited?
No. CVE-2026-72278 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.