SB2026081698 - Always-Incorrect Control Flow Implementation in Linux kernel include hyp

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-72280)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper handling of a warning condition in nested virtualization system register handling when a guest writes to the ZCR_EL2 system register alias in a nested context. A remote user can trigger the bogus warning to cause a denial of service.

Exploitation requires nested virtualization with FEAT_NV2 advertised to the L1 hypervisor.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5000bcae71c869cba6674c326fec2d8ad659ae3a
• https://git.kernel.org/stable/c/6561597dba97e3e8479a9919bda172cf43eb902c
• https://git.kernel.org/stable/c/7deadbc5dab5b8e2316364603bc6281129c8461c
• https://git.kernel.org/stable/c/9f1667098c6ae7ec81a9a56859cfdacb822aa0d0