CVE-2026-53200 Overview
CVE-2026-53200 affects the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for arm64 nested virtualization. The flaw resides in the handling of the XN[0] (Execute-Never) bit when the FEAT_XNX feature is not available. Kernel code incorrectly applies FIELD_PREP() to a value that has already been extracted from its bitfield position. The effect is that execute permissions are granted unconditionally, undermining a memory protection control intended to block instruction fetches from data pages within nested guests.
Critical Impact
Improper bit manipulation in KVM arm64 nested virtualization causes execute permissions to be granted unconditionally, weakening guest memory protections.
Affected Products
- Linux kernel builds supporting KVM arm64 nested virtualization (KVM: arm64: nv)
- arm64 systems where FEAT_XNX is not implemented
- Downstream distributions tracking the affected upstream commits prior to the fix
Discovery Timeline
- 2026-06-25 - CVE-2026-53200 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53200
Vulnerability Analysis
The vulnerability exists in the KVM arm64 nested virtualization (nv) subsystem, specifically in stage-2 translation handling for guests running under an arm64 hypervisor. The XN (Execute-Never) bits in arm64 page table descriptors control whether a memory region may be executed. When FEAT_XNX is not available, only a single XN bit is meaningful, and code paths must clear or manipulate XN[0] correctly.
The affected logic extracts XN from its bitfield position into a local value but then applies FIELD_PREP() against the original bitfield mask. FIELD_PREP() shifts the value back into the field position, so applying it to an already-extracted value corrupts the mask used to clear XN[0]. The end result is that the XN[0] bit is never properly cleared or evaluated, and execute permissions are granted unconditionally.
Root Cause
The root cause is incorrect use of the FIELD_PREP() macro on a value that has already been shifted out of its bitfield position. This is a logic error in bit manipulation rather than a memory safety issue, classified broadly under improper access control for guest memory permissions in nested virtualization.
Attack Vector
Exploitation requires a nested KVM arm64 guest running on a host without FEAT_XNX. A guest hypervisor configuring stage-2 page tables expecting XN[0] semantics will see its non-executable memory regions become executable. An attacker with control of guest workloads could place shellcode in regions intended to be data-only and execute it, bypassing W^X enforcement provided by the nested guest configuration. Specific exploitation details depend on the guest OS and workload.
The fix manipulates the correct bit directly rather than passing an already-extracted value through FIELD_PREP(). See the upstream commits Linux Kernel Commit 49b32dd and Linux Kernel Commit b95976c for the patch.
Detection Methods for CVE-2026-53200
Indicators of Compromise
- No public indicators of compromise are associated with CVE-2026-53200 at the time of publication.
- Unexpected execution of data pages within nested arm64 guests may indicate exploitation of the unconditional execute permission grant.
Detection Strategies
- Inventory arm64 hosts running KVM with nested virtualization enabled and identify those lacking FEAT_XNX.
- Compare running kernel versions against the upstream commits 49b32dd and b95976c to confirm the fix is present.
- Audit guest kernel logs for unexpected execution faults or W^X policy violations originating from nested guests.
Monitoring Recommendations
- Monitor host kernel updates and security advisories from Linux distribution vendors for backports of the fix.
- Track KVM-related syslog and audit events on arm64 hosts running nested virtualization workloads.
- Use configuration management tools to detect drift between expected patched kernel versions and deployed hosts.
How to Mitigate CVE-2026-53200
Immediate Actions Required
- Identify arm64 hosts running affected Linux kernels with KVM nested virtualization enabled.
- Apply the upstream kernel patches referenced in commits 49b32dd and b95976c once distribution updates are available.
- Restrict nested virtualization to trusted workloads until patched kernels are deployed.
Patch Information
The upstream fix corrects the bit manipulation so that XN[0] is cleared on the correct bit rather than via an incorrect FIELD_PREP() operation. Patches are available in the upstream Linux kernel stable tree via commits 49b32ddb87a3a109afecea89e55d70f73956b8bc and b95976c2ea446044553a5f469c0bae13553d75ab. Apply distribution-provided kernel updates that include these commits.
Workarounds
- Disable KVM nested virtualization on arm64 hosts where it is not required by unloading or disabling the nested mode kernel parameter for the kvm-arm module.
- Limit guest workloads on affected hosts to trusted tenants until patched kernels are deployed.
- Where possible, schedule nested arm64 workloads on hosts that implement FEAT_XNX, which avoids the affected code path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
