{"id":"CVE-2026-72280","state":"PUBLISHED","title":"KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2\n\nIt is entirely possible for a guest to write to the ZCR_EL2 sysreg alias\nwhile in a nested context, as it is expected if FEAT_NV2 is advertised\nto the L1 hypervisor.\n\nGet rid of the bogus WARN which, since the hyp vectors were installed at\nthis point, has the effect of a hyp_panic...","publishedAt":"2026-08-15T05:55:04.969Z","updatedAt":"2026-10-16T18:55:14.328Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f","status":"affected","lessThan":"6561597dba97e3e8479a9919bda172cf43eb902c","versionType":"git"},{"version":"0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f","status":"affected","lessThan":"5000bcae71c869cba6674c326fec2d8ad659ae3a","versionType":"git"},{"version":"0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f","status":"affected","lessThan":"7deadbc5dab5b8e2316364603bc6281129c8461c","versionType":"git"},{"version":"0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f","status":"affected","lessThan":"9f1667098c6ae7ec81a9a56859cfdacb822aa0d0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/kvm/hyp/include/hyp/switch.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/kvm/hyp/include/hyp/switch.h"]}],"references":["https://git.kernel.org/stable/c/6561597dba97e3e8479a9919bda172cf43eb902c","https://git.kernel.org/stable/c/5000bcae71c869cba6674c326fec2d8ad659ae3a","https://git.kernel.org/stable/c/7deadbc5dab5b8e2316364603bc6281129c8461c","https://git.kernel.org/stable/c/9f1667098c6ae7ec81a9a56859cfdacb822aa0d0"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72280.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72280","state":"PUBLISHED","datePublished":"2026-08-15T05:55:04.969Z","dateUpdated":"2026-10-16T18:55:14.328Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.916Z"},"containers":{"cna":{"title":"KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2\n\nIt is entirely possible for a guest to write to the ZCR_EL2 sysreg alias\nwhile in a nested context, as it is expected if FEAT_NV2 is advertised\nto the L1 hypervisor.\n\nGet rid of the bogus WARN which, since the hyp vectors were installed at\nthis point, has the effect of a hyp_panic..."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f","status":"affected","lessThan":"6561597dba97e3e8479a9919bda172cf43eb902c","versionType":"git"},{"version":"0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f","status":"affected","lessThan":"5000bcae71c869cba6674c326fec2d8ad659ae3a","versionType":"git"},{"version":"0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f","status":"affected","lessThan":"7deadbc5dab5b8e2316364603bc6281129c8461c","versionType":"git"},{"version":"0cfc85b8f5cf3b77463d61542191c75ba0cc3a5f","status":"affected","lessThan":"9f1667098c6ae7ec81a9a56859cfdacb822aa0d0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/kvm/hyp/include/hyp/switch.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/kvm/hyp/include/hyp/switch.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/6561597dba97e3e8479a9919bda172cf43eb902c"},{"url":"https://git.kernel.org/stable/c/5000bcae71c869cba6674c326fec2d8ad659ae3a"},{"url":"https://git.kernel.org/stable/c/7deadbc5dab5b8e2316364603bc6281129c8461c"},{"url":"https://git.kernel.org/stable/c/9f1667098c6ae7ec81a9a56859cfdacb822aa0d0"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached when guest code in a nested KVM context executes an MSR/MRS to ZCR_EL2 that traps to EL2, traversing KVM_RUN → hyp fast-path kvm_hyp_handle_zcr_el2() → kvm_hyp_handle_fpsimd(); this requires local guest execution on an arm64 VHE KVM host, not remote network input.\nAC:L - On arm64 VHE hosts with nested virtualization (FEAT_NV2) and SVE enabled, a tenant guest in nested context (L1 non-hyp or L2) can deterministically issue the ZCR_EL2 access that hits the bogus WARN; the attacker controls the trap timing and FP/SVE lazy-switch preconditions without uncontrollable host races.\nPR:N - No host root or init-namespace capabilities are required—exploitation needs only code execution inside an assigned KVM guest with nested virtualization and SVE enabled (typical nested-virt ARM cloud tenant), not privileged access on the physical host itself.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own nested/SVE-enabled guest workload; triggering is fully automated via a single guest MSR to ZCR_EL2 that traps into the hypervisor fast path.\nS:C - A guest-triggered WARN in EL2 hypervisor code escalates to hyp_panic(), crashing the host kernel and denying all co-resident VMs—crossing the guest-to-host KVM virtualization security boundary even though exploitation is denial-of-service rather than memory corruption.\nC:N - The failure mode is WARN_ON_ONCE → hyp_panic with no out-of-bounds access, use-after-free, or memory corruption; it is a deterministic hypervisor assertion panic without an information disclosure or memory-read primitive.\nI:N - No guest-controlled kernel memory write or control-flow hijack occurs; the bogus WARN aborts via hyp_panic before any exploitable state mutation beyond crashing the host, and the removed check was incorrectly rejecting a legitimate nested ZCR_EL2 write path.\nA:H - WARN_ON_ONCE in EL2 with hyp vectors installed invokes hyp_panic() and host panic(), immediately denying availability of the hypervisor and every VM on the affected arm64 KVM host; the attack is repeatable on each ZCR_EL2 trap while nested virt and SVE remain enabled."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:42:15.995Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72280","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T18:45:36.633652Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:55:14.328Z"}}]}}}