{"cve":"CVE-2026-72277","nvd":{"published":"2026-08-15T06:21:57.750","modified":"2026-08-17T06:18:30.240","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory\n\nWhen constructing an L1 VNCR mapping, KVM unconditionally uses cacheable\nmemory attributes, even if the underlying PFN isn't memory. This gets\nparticularly hairy if the endpoint doesn't support cacheable memory\nattributes, potentially throwing an SError on writeback...\n\nWhile KVM does permit cacheable memory attributes on certain PFNMAP\nVMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the\nsimpler thing for now and just reject everything that isn't memory.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":9.3},"cwes":[],"references":["https://git.kernel.org/stable/c/4bd7dbe0b2243e6aa735cae4d5e1ff988b30b2a6","https://git.kernel.org/stable/c/bc00e0e376ee3572f5d26c174473abef1e35decc","https://git.kernel.org/stable/c/d5436e18e4fc2886ac306304d884ea3b92e1edbf"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72277","score":0.00194,"percentile":0.09082,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}