CVE-2026-53200: Linux KVM ARM64 Execute Permission Bug

Technical summary

The vulnerability exists in the KVM ARM64 nested virtualization (nv) code path that handles the XN (Execute-Never) permission bit. When the XNX feature is absent, the kernel attempts to clear XN[0] using FIELD_PREP() on an already-extracted bitfield value. Because XN has been extracted from its original bitfield position, applying FIELD_PREP() with the mask causes the operation to unconditionally set execute permissions rather than clear them. The fix involves directly manipulating the correct bit position instead of using the bitfield preparation macro on already-shifted data. This is a logic error that inverts the intended security control.

Business impact

Organizations running KVM-based hypervisors on ARM64 infrastructure face potential privilege escalation and code execution risks. Virtualization security boundaries become compromised, allowing guest workloads or unprivileged host processes to execute code in protected memory regions. For cloud providers, managed Kubernetes clusters, and enterprises using ARM64 servers for virtualization, this could lead to guest-to-host escape scenarios or lateral movement between isolated virtual machines. Data confidentiality and integrity of other VMs on the same physical host may be at risk.

Affected systems

The Linux kernel is affected across versions that include the vulnerable KVM ARM64 nested virtualization code. Specifically impacted are systems running KVM on ARM64 processors that lack the XNX (Execute-Never eXtended) feature and use nested virtualization. This includes cloud infrastructure, on-premises ARM64 server deployments, and embedded systems using KVM for isolation. The vulnerability requires local access and the ability to interact with KVM, limiting exposure in some environments but remaining significant for multi-tenant scenarios.

Exploitability

Exploitation requires local access (privilege level L) with the ability to manage or create virtual machines through KVM. The vulnerability is locally exploitable without user interaction (UI:N) and can affect multiple security domains (S:C), making it highly exploitable in multi-tenant virtualization environments. However, an attacker cannot trivially exploit this over a network; they must have shell access or be a process with KVM management capabilities. The straightforward nature of the code defect (a bitfield operation inversion) means exploitation is relatively straightforward once local access is established.

Remediation

Apply the kernel patch that corrects the bit manipulation logic in the KVM ARM64 nested virtualization code. Verify the patch against official Linux kernel security advisories and your distribution's kernel release notes. For distributions, monitor your vendor's security update channels for patched kernel versions. Interim mitigation involves disabling nested virtualization if not required (check KVM module parameters) or restricting local access to users who cannot launch virtual machines.

Patch guidance

Obtain and install the patched Linux kernel version from your distribution's repository or from kernel.org. Verify patch application by reviewing the KVM ARM64 nv code in your running kernel or checking kernel version release notes against vendor security advisories. Test the patched kernel in a staging environment before production deployment, particularly if running critical virtualization workloads. Reboot systems to load the patched kernel.

Detection guidance

Monitor kernel logs and hypervisor audit trails for unexpected execute permissions on non-executable memory regions in guest or nested VM contexts. Review KVM event traces for anomalous memory permission changes. On ARM64 systems, check whether nested virtualization is enabled and whether the system lacks XNX support (query CPU capabilities). Intrusion detection systems with ARM64 hypervisor visibility may detect attempts to exploit memory execute permission inconsistencies. Behavioral monitoring of unprivileged processes attempting to execute code in protected regions may surface exploitation attempts.

Why prioritize this

This defect directly undermines memory execute permission controls in a widely-used virtualization platform. The CVSS 8.8 (HIGH) score reflects high impact (confidentiality, integrity, and availability all compromised) with low attack complexity and local accessibility. While it requires local access, the multitenancy nature of modern virtualization means this represents a significant guest-to-host and cross-VM compromise risk. Organizations with ARM64 KVM deployments, particularly those offering virtualization as a service, should prioritize patching.

Risk score, explained

CVSS 3.1 score of 8.8 reflects: Attack Vector Local (AV:L)—attacker must have local system access; Attack Complexity Low (AC:L)—exploitation does not require special conditions or user interaction; Privileges Required Low (PR:L)—attacker needs basic local user or VM management privileges; User Interaction None (UI:N)—no social engineering required; Scope Changed (S:C)—the vulnerability affects resources beyond its immediate scope (cross-VM impact); Confidentiality High (C:H), Integrity High (I:H), Availability High (A:H)—full compromise of VMs and hypervisor security. The combination of a fundamental security control failure with multitenancy impact justifies the HIGH severity.

Frequently asked questions