Linux kernel KVM arm64 NV: unresolvable VNCR translation crashes the host instead of injecting an abort

Impact

kvm_handle_vncr_abort() assumed that a -EFAULT from kvm_translate_vncr() always carried a stage-1 walk abort, but late failures - such as a guest frame number outside any memslot - reach it without one, and the fault-injection path then hit a BUG_ON. A guest able to drive that path takes the host kernel down rather than receiving an external abort, which is why the record scores it scope-changed with high availability impact. On an arm64 GPU host that means every other tenant's pods on the node die with it and the node needs a cold recovery. Exposure is narrow: it requires an arm64 host running KVM nested virtualization, so x86_64 fleets and arm64 fleets not running NV guests are unaffected.

Who can reach it

A guest running under nested virtualization on an arm64 KVM host. No host credentials are needed - the ability to run a VM on the node is enough. Not reachable on x86_64 hosts, and not reachable on arm64 hosts where NV is not in use.

What to do

Move to a stable kernel containing the fix (commits 4ead4def, 53804b68, 9f3e8334 in the stable tree) and reboot each affected node; there is no runtime mitigation short of not exposing nested virtualization to guests. Fixed release numbers are not stated in the record, so match the commit against your distribution's kernel changelog before scheduling the window. Drain and reboot arm64 KVM hosts in maintenance batches - workloads must be rescheduled, since a live kernel patch is not offered here.

References

Related entries

• Linux kernel mm: snapshot_page() reads a non-existent tail page for order-1 folios and oopses the hostCVE-2026-80685 · Linux kernel mm/util snapshot_page() (order-1 folio tail-page read)High
• KVM: Improper handling of VM_IO/VM_PFNMAP vmas in KVM lets a guest bypass read-only checksCVE-2021-22543 · KVMHigh
• Linux kernel (af_packet): Double free in packet_set_ring(), local privilege escalationCVE-2021-22600 · Linux kernel (af_packet)High
• Linux kernel (eBPF): eBPF improper input validation leading to local privilege escalationCVE-2021-4204 · Linux kernel (eBPF)High
• Linux kernel (cgroups v1): cgroups v1 release_agent lets a container with CAP_SYS_ADMIN (or an unconfined userns) runCVE-2022-0492 · Linux kernel (cgroups v1)High
• Linux kernel (io_uring): Use-after-free between io_uring and the unix GC - local rootCVE-2022-2602 · Linux kernel (io_uring)High