CVE-2026-80665: KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Inject SEA if kvmtranslatevncr() can't resolve PFN
kvmhandlevncrabort() assumes that s1walkresult conveys an abort when kvmtranslatevncr() returns -EFAULT. This is not always the case as it's possible to encounter 'late' failures on the output of S1 translation, e.g. a GFN outside of the memslots.
Fix it by preparing an external abort before returning from kvmtranslatevncr(). Get rid of the BUGON() in the fault injection path while at it.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue is in the Linux kernel's KVM arm64 nested-virtualization (nv) handling. Systems not using KVM on arm64, or not exercising this nested-virtualization VNCR abort path, are not indicated by the provided information as exposed.
What condition triggers the faulty path?
The path can be reached when kvm_translate_vncr() cannot resolve a PFN after stage-1 translation, including a late failure such as a guest frame number outside configured memslots. The vulnerable handling incorrectly assumes that an -EFAULT result always includes an abort in the stage-1 walk result.
What is the immediate mitigation if an updated kernel cannot be deployed?
The provided information supports avoiding the affected KVM arm64 nested-virtualization path. In particular, do not enable or use nested virtualization workloads that can access VNCR mappings resulting in unresolved PFNs or GFNs outside memslots.
How does the fix change behavior?
The fix prepares an external abort, specifically an injected SEA, before kvm_translate_vncr() returns when it cannot resolve the PFN. It also removes a BUG_ON() from the fault-injection path.