{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-80665", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-80665" ], "published": "2026-08-28T06:50:33Z", "summary": "KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN\n\nkvm_handle_vncr_abort() assumes that s1_walk_result conveys an abort\nwhen kvm_translate_vncr() returns -EFAULT. This is not always the case\nas it's possible to encounter 'late' failures on the output of S1\ntranslation, e.g. a GFN outside of the memslots.\n\nFix it by preparing an external abort before returning from\nkvm_translate_vncr(). Get rid of the BUG_ON() in the fault injection\npath while at it.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80665" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/4ead4def04659739c399bfcb063f8a906194c79f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/53804b6839573c9c6fff5f4cf075d6746267345e" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/9f3e83345a56280efffe235c65593c7e544c0fcc" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-29T06:25:05Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.1, "cvss_v3_severity": "High", "scenario": "AV:L - The bug is reached only when an arm64 nested-KVM L1 hypervisor triggers VNCR_EL2 data aborts (ESR_ELx_EC_DABT_CUR with ESR_ELx_VNCR) during KVM_RUN via kvm_handle_vncr_abort(); no network, adjacent-radio, or physical-device path reaches this code.\nAC:L - An attacker controlling an L1 nested-hypervisor VM can reliably set VNCR_EL2 and guest EL2 page tables so stage-1 translation succeeds but the resulting GFN is outside host memslots or PFN resolution fails, deterministically hitting the faulty -EFAULT path; nested virt on arm64 cloud hosts is an attacker-selectable deployment.\nPR:N - Exploitation requires no host root or init-namespace capabilities beyond running hypervisor code in a tenant KVM guest on an arm64 host with nested virtualization enabled; the attacker operates entirely from within their assigned VM, consistent with other arm64 KVM nested-virt CVE scoring.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own nested-virtualization workload; VNCR faults, page-table configuration, and repeated translation triggers are fully attacker-driven from within the guest.\nS:C - A malicious nested guest forces host KVM into BUG_ON(!vt->wr.failed) during VNCR abort handling, crashing the physical host kernel and denying service to all co-resident VMs, crossing the guest-to-hypervisor security boundary beyond the guest's intended authority.\nC:N - The vulnerability triggers a host kernel BUG_ON panic on a late translation failure without setting s1_walk_result.failed; there is no out-of-bounds read, use-after-free, or other information-disclosure primitive\u2014only an incorrect assumption leading to host crash.\nI:N - Impact is limited to host kernel panic via BUG_ON on the fault-injection path; no guest or host data is modified, no arbitrary write primitive exists, and the fix only prepares an external abort for reinjection to the nested guest.\nA:H - BUG_ON(!vt->wr.failed) on the late -EFAULT path causes an uncontained host kernel panic on production kernels (CONFIG_BUG=y), crashing the hypervisor and denying availability to every workload on the affected physical machine; the attacker can retrigger after reboot." } } }