GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-53200 (GCVE-0-2026-53200)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34
VLAI
Title
KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX XN has already been extracted from its bitfield position so using FIELD_PREP() on the mask that clears XN[0] is completely broken, having the effect of unconditionally granting execute permissions... Fix the obvious mistake by manipulating the right bit.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d93febe2ed2e0491af9d47f0ee6d4b01918877f4 , < b95976c2ea446044553a5f469c0bae13553d75ab (git)
Affected: d93febe2ed2e0491af9d47f0ee6d4b01918877f4 , < 49b32ddb87a3a109afecea89e55d70f73956b8bc (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b95976c2ea446044553a5f469c0bae13553d75ab",
              "status": "affected",
              "version": "d93febe2ed2e0491af9d47f0ee6d4b01918877f4",
              "versionType": "git"
            },
            {
              "lessThan": "49b32ddb87a3a109afecea89e55d70f73956b8bc",
              "status": "affected",
              "version": "d93febe2ed2e0491af9d47f0ee6d4b01918877f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_nested.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX\n\nXN has already been extracted from its bitfield position so using\nFIELD_PREP() on the mask that clears XN[0] is completely broken, having\nthe effect of unconditionally granting execute permissions...\n\nFix the obvious mistake by manipulating the right bit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable KVM arm64 nested-virtualization path is reached by local KVM ioctls and guest execution through /dev/kvm, not by network packets or physical access.\nAC:L - Once nested virtualization is available and FEAT_XNX is absent or not exposed, the faulty mask deterministically treats nested stage-2 translations as executable. The attacker controls the guest execution and the relevant nested stage-2 descriptors in the practical attack setup.\nPR:L - The attacker needs local ability to create/run a KVM VM with nested EL2 enabled, but the traced ioctl path does not require real root or CAP_SYS_ADMIN. This is low privilege rather than high privilege.\nUI:N - No victim action is required after the attacker can run the nested VM; execution faults and shadow stage-2 mappings are handled automatically by KVM.\nS:C - The bug is in the host KVM enforcement of L1-controlled stage-2 execute permissions and can let an L2 guest violate the L1 hypervisor\u0027s security policy. That crosses a virtualization security boundary.\nC:H - By bypassing L1-enforced execute-never/W^X policy, an attacker can plausibly gain arbitrary execution in a protected nested guest context and read data protected by that policy. There is no host memory-corruption primitive, but the crossed nested-virtualization boundary supports high confidentiality impact.\nI:H - The flaw directly grants execute permission where the L1 stage-2 page tables intended to deny it. This can allow attacker-controlled code execution and full integrity compromise of the protected nested guest context.\nA:H - Arbitrary execution after bypassing the nested execute restriction can be used to crash or halt the protected guest/security domain. No host kernel panic is required for high availability impact across that boundary."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:03.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b95976c2ea446044553a5f469c0bae13553d75ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/49b32ddb87a3a109afecea89e55d70f73956b8bc"
        }
      ],
      "title": "KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53200",
    "datePublished": "2026-06-25T08:39:08.968Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-08-05T12:34:03.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53200",
      "date": "2026-09-16",
      "epss": "0.00165",
      "percentile": "0.0612"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53200\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-25T09:16:37.577\",\"lastModified\":\"2026-07-06T12:32:25.270\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX\\n\\nXN has already been extracted from its bitfield position so using\\nFIELD_PREP() on the mask that clears XN[0] is completely broken, having\\nthe effect of unconditionally granting execute permissions...\\n\\nFix the obvious mistake by manipulating the right bit.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/include/asm/kvm_nested.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d93febe2ed2e0491af9d47f0ee6d4b01918877f4\",\"lessThan\":\"b95976c2ea446044553a5f469c0bae13553d75ab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d93febe2ed2e0491af9d47f0ee6d4b01918877f4\",\"lessThan\":\"49b32ddb87a3a109afecea89e55d70f73956b8bc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/include/asm/kvm_nested.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.13\",\"matchCriteriaId\":\"6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"81DFF19E-9CF8-49C6-8C36-1E4038622933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E8FC71-3952-444C-83E9-718DBBBEC615\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/49b32ddb87a3a109afecea89e55d70f73956b8bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b95976c2ea446044553a5f469c0bae13553d75ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:31:59+00:00",
      "cve": "CVE-2026-53200",
      "id": "CVE-2026-53200",
      "initial_release_date": "2026-06-25T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53200.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:14:07Z",
      "cve": "CVE-2026-53200",
      "id": "CVE-2026-53200",
      "initial_release_date": "2026-06-26T02:10:18Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53200",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53200.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.