CVE-2026-80665

CVE-2026-80665 is a correctness flaw in the Linux kernel's KVM implementation for ARM64, in the code path that handles guest aborts when nested virtualization (the VNCR translation path) is in use. When kvm_translate_vncr() hits a 'late' stage-1 translation failure — for example, when the translated guest frame number falls outside the VM's memslots — the caller kvm_handle_vncr_abort() wrongly assumes the walk result already carries the abort information, so a synchronous external abort (SEA) is not properly prepared and a BUG_ON() in the fault-injection path can be hit. An attacker who can run code in this context (an unprivileged local actor on a host or in a guest using nested virtualization) can trigger the condition and crash the host kernel, causing a high-impact availability-only denial of service, consistent with the CVSS 7.1 score (AV:L, scope changed, A:H). Affected systems are Linux kernels carrying the KVM arm64 nested-virtualization code; the source data does not specify exact affected or fixed version ranges. Exploitation status is quiet: there is no known public proof-of-concept, the CVE is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Apply the upstream fix ('KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN') via your distribution's kernel update as soon as it is backported. Until patched, avoid enabling nested virtualization (NV/NV2) for untrusted guests on ARM64 KVM hosts, and check host logs for KVM BUG_ON()/WARN splats in the VNCR fault path that would indicate attempted triggers. No public exploit is known, so patching can follow normal maintenance cadence for most deployments.