Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN kvm_handle_vncr_abort() assumes that s1_walk_result conveys an abort when kvm_translate_vncr() returns -EFAULT. This is not always the case as it's possible to encounter 'late' failures on the output of S1 translation, e.g. a GFN outside of the memslots. Fix it by preparing an external abort before returning from kvm_translate_vncr(). Get rid of the BUG_ON() in the fault injection path while at it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-28T08:16:51.747Z",
  "pubdate": "2026-08-28T08:16:51.747Z",
  "executiveSummary": "This vulnerability involves an improper error handling mechanism within the Linux kernel KVM (Kernel-based Virtual Machine) hypervisor for the arm64 architecture, specifically concerning Nested Virtualization (NV).\nThe flaw resides in the kvm_handle_vncr_abort() function, which incorrectly assumes that a failure returned by kvm_translate_vncr() consistently implies a stage-1 translation abort.\nUnder specific conditions, such as a Guest Frame Number (GFN) falling outside of assigned memory slots, the translation may fail due to post-translation validation errors rather than aborts.\nThis mismatch leads to an unhandled exception state where the hypervisor may fail to appropriately signal the guest, potentially causing system instability or kernel panics due to the previous reliance on a BUG_ON() assertion.\nThe vulnerability affects KVM on arm64 systems with nested virtualization enabled. An attacker capable of triggering specific memory access patterns that result in 'late' translation failures could exploit this to induce a Denial of Service (DoS) by crashing the host kernel. No specific network exposure is required, as the attacker must be capable of executing code within a guest environment that interacts with virtualized system registers via VNCR (Virtual Network Control Register) mechanisms.",
  "technicalDetails": "The vulnerability originates in the architectural implementation of nested virtualization within the KVM arm64 subsystem, specifically in the handling of VNCR-backed system register accesses.\nWhen a guest performs an access that necessitates a VNCR lookup, the function kvm_handle_vncr_abort() is invoked to manage the trap. This function relies on kvm_translate_vncr() to resolve the Physical Frame Number (PFN) associated with the guest's request.\nPreviously, the implementation assumed that any return value of -EFAULT from kvm_translate_vncr() was strictly synonymous with a stage-1 page table walk abort. This assumption is flawed because the translation process can undergo 'late' failures—errors occurring after the page table walk is technically complete, such as when the resulting GFN is outside the bounds of the established KVM memslots.\nIn the event of such a late failure, the s1_walk_result structure does not accurately represent a fault that can be handled by standard abort injection logic. The original code utilized a BUG_ON() assertion in the fault injection path, which, upon receiving an unexpected state, would trigger an immediate kernel panic, resulting in a host-level denial of service.\nThe exploit flow involves a guest triggering a VNCR access that maps to a memory region not backed by a valid KVM memslot. When the hypervisor attempts to translate this address, kvm_translate_vncr() returns an error code. Because the hypervisor does not properly prepare an External Abort (SEA) for the guest when this 'late' failure occurs, the internal logic attempts to process non-existent fault information. By eliminating the BUG_ON() check and explicitly preparing an External Abort within kvm_translate_vncr() before returning control, the kernel can now gracefully report the error to the guest as a synchronous data abort rather than crashing the host.\nThis vulnerability is critical in environments where guests are untrusted, as it provides a trivial vector for crashing the host hypervisor. The lack of proper exception propagation from the hypervisor to the guest represents a failure in the isolation boundary for nested virtualization."
}