CVE-2026-80873: Linux Kernel KVM Privilege Escalation Flaw

CVE-2026-80873 Overview

CVE-2026-80873 is a Linux kernel vulnerability in the KVM arm64 nested virtualization subsystem. The flaw affects how kvm_inject_el2_exception() handles injected nested SError exceptions. The function writes ESR_EL2 for synchronous exceptions but omits the write for SError, and enter_exception64() does not write ESR_ELx for any exception type. As a result, the constructed syndrome is dropped, and an L2 guest hypervisor observing a nested SError sees stale ESR_EL2 data. The issue affects both kvm_inject_nested_serror() and the EASE path in kvm_inject_nested_sea().

Critical Impact
Nested guest hypervisors on arm64 receive stale ESR_EL2 syndrome values when handling injected SError exceptions, potentially causing incorrect exception handling logic in L2 hypervisors running under KVM.

Affected Products

Linux kernel with KVM arm64 nested virtualization (NV) support enabled
arm64 systems hosting L2 hypervisors via KVM
Distributions shipping affected upstream KVM arm64 code prior to the fix

Discovery Timeline

2026-09-04 - CVE-2026-80873 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80873

Vulnerability Analysis

The vulnerability resides in the KVM arm64 nested virtualization code path responsible for injecting exceptions into a guest hypervisor. On arm64, ESR_EL2 is the Exception Syndrome Register at EL2 that describes the cause of an exception taken to EL2. When KVM emulates nested virtualization, it must construct a syndrome value and deliver it alongside the exception so the L2 hypervisor can decode the fault.

kvm_inject_el2_exception() correctly writes ESR_EL2 for synchronous exceptions but skips the write for the except_type_serror path. The downstream helper enter_exception64() does not write ESR_ELx for any exception type either. The constructed SError syndrome is therefore never committed to the register. This affects both kvm_inject_nested_serror() and the EASE (SError-based abort injection) path in kvm_inject_nested_sea().

Root Cause

The root cause is a missing register write in the exception-injection state machine. The KVM code assumed enter_exception64() would propagate the syndrome, but that helper only handles PC, PSTATE, and stacking of context, not ESR_ELx. The fix writes ESR_EL2 for except_type_serror, mirroring the existing behavior for except_type_sync.

Attack Vector

The issue requires a KVM host running an L2 guest hypervisor via arm64 nested virtualization. When KVM injects a nested SError into the L2 hypervisor, the L2 reads stale ESR_EL2 and misinterprets the exception cause. This is a virtualization correctness defect rather than a direct memory-corruption primitive, but incorrect syndrome delivery can lead to erroneous fault handling inside the L2 hypervisor and downstream L2 guests. No public exploit is available and the issue is not listed in CISA KEV.

No verified proof-of-concept code is available. See the upstream fix commits for technical details: Kernel Git Commit 09f35145, Kernel Git Commit 29227821, and Kernel Git Commit e2cb1f45.

Detection Methods for CVE-2026-80873

Indicators of Compromise

No file-based or network IOCs apply. This is a kernel correctness bug, not a malware artifact.
L2 hypervisor logs reporting unexpected or stale ESR_EL2 values during SError handling may indicate exposure to the flaw.
Kernel version strings on arm64 hosts predating the upstream fix commits identify vulnerable systems.

Detection Strategies

Inventory arm64 hosts running KVM with nested virtualization (NV) enabled and compare kernel commit hashes against the upstream fixes.
Audit distribution security trackers for backports referencing commits 09f35145, 29227821, and e2cb1f45.
Track guest hypervisor crash reports and anomalous SError handling behavior on nested workloads.

Monitoring Recommendations

Monitor kernel package versions on arm64 virtualization hosts and alert on drift from patched baselines.
Enable KVM tracepoints for exception injection paths on test systems to validate syndrome delivery after patching.
Review host and guest dmesg output for KVM warnings related to nested exception injection.

How to Mitigate CVE-2026-80873

Immediate Actions Required

Identify arm64 KVM hosts with nested virtualization enabled and prioritize them for patching.
Apply the upstream kernel fixes referenced in commits 09f35145, 29227821, and e2cb1f45 or the corresponding vendor backport.
Rebuild or update kernel packages and reboot affected hosts during a maintenance window.

Patch Information

The fix writes ESR_EL2 for except_type_serror in kvm_inject_el2_exception(), matching the existing behavior for except_type_sync. The patch is available in the upstream stable trees. Refer to Kernel Git Commit 09f35145, Kernel Git Commit 29227821, and Kernel Git Commit e2cb1f45.

Workarounds

Disable KVM nested virtualization on arm64 hosts until the patched kernel is deployed.
Avoid running L2 guest hypervisors on unpatched arm64 KVM hosts.
Restrict guest hypervisor workloads to hosts already running fixed kernel builds.

bash

# Verify kernel version and check for the fix on an arm64 KVM host
uname -r
# Confirm the nested virtualization module parameter state
cat /sys/module/kvm_arm/parameters/nested 2>/dev/null || echo "nested parameter not present"
# Temporarily disable nested virtualization until patched
# (edit modprobe config, then reload the kvm_arm module)
echo 'options kvm-arm nested=0' | sudo tee /etc/modprobe.d/kvm-arm-nested.conf