Executive brief
A vulnerability in the Linux kernel's virtualization component (KVM) for ARM64 processors could allow unintended program execution. Specifically, a logic error in how the system handles memory permissions could mistakenly grant execute permissions to memory regions that should be restricted. This could potentially allow a malicious user or guest virtual machine to bypass security protections and run unauthorized code.
Technical details
A vulnerability exists in the Linux kernel's KVM arm64 nested virtualization (NV) support within 'arch/arm64/include/asm/kvm_nested.h'. The root cause is an incorrect use of the FIELD_PREP() macro on a value that had already been extracted via FIELD_GET(). When the FEAT_XNX (Extended Execute-never) feature is not present, the code intended to mask bits in the XN field but instead corrupted the bitmask, resulting in execute permissions being granted unconditionally. This affects shadow stage-2 page table translations for both EL0 and EL1. An attacker with the ability to influence guest stage-2 translations could exploit this to execute code in non-executable memory regions. The issue has been patched in the stable kernel tree.
Affected products
- Linux Linux Kernel 6.19, 7.0.13
Timeline
- 2026-06-02: other: Patch authored
- 2026-06-25: disclosed: CVE published