Executive brief
KVM (Kernel Virtual Machine) on ARM64 processors allows userspace to send virtual CPU events before the CPU is properly initialized, causing the hypervisor to process uninitialized data. An attacker can crash the KVM subsystem or put a virtual machine into an invalid state, disrupting virtual machine operations and potentially affecting multiple VMs on the same physical host.
Technical details
The vulnerability is an initialization-order bypass in KVM's ARM64 vCPU event injection code. Userspace can invoke ioctl calls (__kvm_arm_vcpu_set_events) to pend vCPU events on an uninitialized vCPU, causing the kernel to interpret uninitialized memory for exception routing and injection. The root cause is missing pre-condition validation before processing event ioctl calls. Attack vector is local (ioctl-based, privileged userspace access required), but no authentication is required once access to /dev/kvm is obtained. An attacker can trigger kernel panics via illegal vCPU state transitions (e.g., putting a 64-bit vCPU into an illegal mode), as demonstrated by the BUG() in exception_target_el(). The fix rejects these ioctl calls before vCPU initialization (KVM_ARM_VCPU_INIT), following the principle that any sane VMM would initialize the vCPU first.
Affected products
- Linux Linux kernel up to and including 6.17.0-rc4
Timeline
- 2025-10-30: disclosed