CVE-2026-80665 Overview
CVE-2026-80665 is a Linux kernel vulnerability in the KVM arm64 nested virtualization subsystem. The flaw lives in kvm_handle_vncr_abort(), which incorrectly assumes that s1_walk_result always describes an abort when kvm_translate_vncr() returns -EFAULT. Late failures on the output of Stage-1 translation, such as a Guest Frame Number (GFN) falling outside configured memslots, break this assumption. The upstream fix prepares an external Synchronous External Abort (SEA) before returning from kvm_translate_vncr() and removes a BUG_ON() in the fault injection path.
Critical Impact
A local attacker with the ability to run a guest VM on an affected arm64 KVM host can trigger a kernel-side condition leading to high-availability impact on the host.
Affected Products
- Linux kernel arm64 KVM nested virtualization (arch/arm64/kvm/)
- Stable branches receiving backports referenced in commits 4ead4de, 53804b6, and 9f3e833
- Distributions shipping affected arm64 kernels with nested virtualization enabled
Discovery Timeline
- 2026-08-28 - CVE-2026-80665 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80665
Vulnerability Analysis
The vulnerability resides in the arm64 KVM Nested Virtualization (NV) code path that handles Virtual Nested Control Register (VNCR) aborts. When a guest triggers a translation for a VNCR page, kvm_translate_vncr() walks Stage-1 tables and may return -EFAULT for multiple distinct reasons. The caller, kvm_handle_vncr_abort(), treats every -EFAULT return as if s1_walk_result carries valid abort context. This assumption breaks when the failure occurs after Stage-1 translation succeeds, for example when the resulting GFN is not backed by any memslot. The mismatched state reaches a BUG_ON() in the fault injection path, taking down the host kernel [CWE-670: Always-Incorrect Control Flow Implementation].
Root Cause
The root cause is an improper control-flow assumption between kvm_translate_vncr() and kvm_handle_vncr_abort(). The translator can fail late without populating the walk-result structure that the abort handler needs. The fix centralizes preparation of an external abort inside kvm_translate_vncr() before it returns, ensuring the caller always has consistent state, and removes the unconditional BUG_ON().
Attack Vector
Exploitation requires local access on an arm64 host running KVM with nested virtualization support. An attacker executing code inside a guest can construct guest page table state that causes Stage-1 translation to yield a GFN outside memslots. The resulting kernel path reaches the flawed abort handler and triggers a host denial of service. Network access is not required, and no host user interaction is involved.
No public proof-of-concept is available. Refer to the Kernel Git Commit 4ead4de for the authoritative fix.
Detection Methods for CVE-2026-80665
Indicators of Compromise
- Unexpected host kernel panics or BUG_ON splats referencing kvm_handle_vncr_abort or kvm_translate_vncr in dmesg and /var/log/kern.log.
- Sudden termination or reset of arm64 guest VMs using nested virtualization, correlated with host instability.
- Repeated Stage-1 translation faults originating from a single guest process or vCPU.
Detection Strategies
- Monitor arm64 KVM hosts for kernel oops signatures containing the affected function names and collect full stack traces for triage.
- Compare running kernel versions against distribution advisories to identify hosts missing the backport commits 4ead4def0465, 53804b683957, and 9f3e83345a56.
- Correlate guest-initiated crashes with tenant identity to detect abuse patterns in multi-tenant arm64 environments.
Monitoring Recommendations
- Forward kernel logs from arm64 hypervisors to a centralized log platform and alert on BUG:, Oops:, and KVM-related panics.
- Track host uptime and unplanned reboots on arm64 KVM nodes as a proxy for exploitation attempts.
- Enable per-guest resource and fault accounting to identify VMs generating anomalous translation faults.
How to Mitigate CVE-2026-80665
Immediate Actions Required
- Inventory arm64 hosts running KVM with nested virtualization enabled and prioritize them for patching.
- Apply the vendor kernel update that includes commits 4ead4def0465, 53804b683957, and 9f3e83345a56.
- Restrict guest creation privileges on unpatched hosts to trusted operators only.
Patch Information
The fix is available upstream in the Linux kernel stable tree. See Kernel Git Commit 4ead4de, Kernel Git Commit 53804b6, and Kernel Git Commit 9f3e833. Rebuild and reboot arm64 hosts after installing the updated kernel package from your distribution.
Workarounds
- Disable KVM nested virtualization on arm64 hosts where it is not required until patches are applied.
- Limit which tenants can run nested guests by tightening libvirt and sVirt policies on affected hosts.
- Migrate sensitive workloads off unpatched arm64 KVM hosts to reduce blast radius from a host crash.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
