CVE-2026-72280

A moderate denial-of-service vulnerability was found in the Linux kernel's KVM subsystem for ARM64 in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When nested virtualization is in use, a guest operating in a nested context may write to the ZCR_EL2 system register alias, which is an expected operation when FEAT_NV2 is advertised to the L1 hypervisor. The kernel incorrectly treats this legitimate write as a warning condition; because the hypervisor vectors are installed at that point, the warning has the effect of a hypervisor panic (hyp_panic), causing a denial of service affecting the host and the virtual machines running on it. Only ARM64 systems that expose KVM nested virtualization to guests are exposed to this flaw; guests that do not run nested virtualization cannot trigger it.

The vulnerable code is not present in Red Hat Enterprise Linux 6, 7, and 8, nor in the Red Hat Enterprise Linux 9.2 and 9.4 update streams, so those products are not affected. The affected Red Hat Enterprise Linux 9 and 10 kernel/kernel-rt streams and Red Hat In-Vehicle OS 2 are marked for a deferred fix because the issue is a guest-triggered denial of service with no impact on confidentiality or integrity; the residual risk is that an attacker able to run code in a guest on an affected ARM64 host with nested virtualization configured could panic the host hypervisor and disrupt all guests running on that host. Red Hat rates this flaw moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream important rating (7.1), because exploitation requires the ability to run code inside a guest on an ARM64 KVM host that has nested virtualization exposed.