Executive brief
The Linux kernel's KVM hypervisor module for ARM64 processors contains a flaw in how it handles memory translation failures during nested virtualization. When a virtual machine attempts to access memory that cannot be properly resolved, the error handling code may fail to properly inject an exception, potentially leading to system instability or denial of service in environments running nested virtual machines on ARM64 systems.
Technical details
This vulnerability exists in KVM's nested virtualization support for ARM64 (arch/arm64/kvm/nested.c), specifically in the kvm_translate_vncr() and kvm_handle_vncr_abort() functions. The root cause is an incorrect assumption: the code assumed that when kvm_translate_vncr() returns -EFAULT, the s1_walk_result structure would always contain valid abort information. However, "late" failures during stage-1 translation output (such as when a guest frame number falls outside valid memory slots or page faulting fails) could leave s1_walk_result uninitialized, and a subsequent BUG_ON() check in kvm_handle_vncr_abort() would trigger a kernel panic. The fix properly initializes the s1_walk_result with an external abort (ESR_ELx_FSC_EXTABT) before returning -EFAULT in failure paths, and removes the unsafe BUG_ON() assertion. The attack vector requires the ability to run or interact with nested virtual machines on an ARM64 KVM host.
Affected products
- Linux Linux kernel 5.x–6.x and later (ARM64 KVM module)
Timeline
- 2026-08-28: disclosed
- 2026-07-24: patched