KVM: arm64 nv: Improper PFN Abort in kvm_translate_vncr() Translation
CVE-2026-80665 Published on August 28, 2026
KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
kvm_handle_vncr_abort() assumes that s1_walk_result conveys an abort
when kvm_translate_vncr() returns -EFAULT. This is not always the case
as it's possible to encounter 'late' failures on the output of S1
translation, e.g. a GFN outside of the memslots.
Fix it by preparing an external abort before returning from
kvm_translate_vncr(). Get rid of the BUG_ON() in the fault injection
path while at it.
Products Associated with CVE-2026-80665
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version 2a359e072596fcb2e9e85017a865e3618a2fe5b5 and below 4ead4def04659739c399bfcb063f8a906194c79f is affected.
- Version 2a359e072596fcb2e9e85017a865e3618a2fe5b5 and below 53804b6839573c9c6fff5f4cf075d6746267345e is affected.
- Version 2a359e072596fcb2e9e85017a865e3618a2fe5b5 and below 9f3e83345a56280efffe235c65593c7e544c0fcc is affected.
- Version 6.16 is affected.
- Before 6.16 is unaffected.
- Version 6.18.40, <= 6.18.* is unaffected.
- Version 7.1.5, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.