CVE-2026-72278

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Re-translate VNCR before injecting abort

KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts

for a write, similar to how a regular stage-2 mapping is handled. It is

entirely possible that the guest reads from the VNCR before writing to

it, in which case the PFN could only be read-only.

Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR

abort, allowing the host mapping to be faulted in for write the second

time around. Interestingly enough, this also satisfies the ordering

requirements of FEAT_ETS2/3 between descriptor updates and MMU faults.