Description
In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX

XN has already been extracted from its bitfield position so using
FIELD_PREP() on the mask that clears XN[0] is completely broken, having
the effect of unconditionally granting execute permissions...

Fix the obvious mistake by manipulating the right bit.
Published: 2026-06-25
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Linux kernel’s KVM memory handling incorrectly clears the XN (execute never) flag for certain pages when the FEAT_XNX feature is not enabled. The bug causes the kernel to unconditionally grant execute permissions to memory that should be non-executable, effectively allowing any process that can target that memory region to run code that was intended to be protected. This represents a CWE-266 flaw.

Affected Systems

The issue is limited to Linux kernel implementations that use KVM with arm64 architecture. Any host system running a kernel version containing the flawed code and configured without FEAT_XNX enables the vulnerability.

Risk and Exploitability

The EPSS score of < 1% indicates a very low but non-zero likelihood of exploitation, and the CVSS score of 8.8 classifies the vulnerability as high severity. The flaw is not listed in CISA KEV, so no publicly documented exploitations are known. An attacker with the ability to influence KVM memory mapping could potentially use the bug to execute arbitrary code within a guest or the host by subverting the XN bit handling.

Generated by OpenCVE AI on June 28, 2026 at 14:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a release that contains the fix for the XN[0] handling bug
  • Ensure that KVM is configured with FEAT_XNX enabled or that memory mappings for guest code are protected by non-executable attributes
  • Deploy the vendor‑supplied kernel update or apply the official patch directly from the Linux kernel sources if no update has been released yet

Generated by OpenCVE AI on June 28, 2026 at 14:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 28 Jun 2026 08:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Fri, 26 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 26 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-266
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Thu, 25 Jun 2026 12:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Thu, 25 Jun 2026 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX XN has already been extracted from its bitfield position so using FIELD_PREP() on the mask that clears XN[0] is completely broken, having the effect of unconditionally granting execute permissions... Fix the obvious mistake by manipulating the right bit.
Title KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-28T06:40:18.167Z

Reserved: 2026-06-09T07:44:35.391Z

Link: CVE-2026-53200

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53200 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-28T14:15:08Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment