Executive brief
KVM on ARM64 systems fails to properly record exception details when injecting nested SError exceptions to guest hypervisors. A guest L2 hypervisor observes stale or incorrect exception status information, potentially causing incorrect error handling and obscuring the true cause of hardware errors in virtualized environments.
Technical details
The vulnerability is a missing register write in KVM's ARM64 nested virtualization exception injection path. The `kvm_inject_el2_exception()` function writes the ESR_EL2 (Exception Syndrome Register) for synchronous exceptions but fails to do so for SError exceptions, causing the exception syndrome to be discarded. This affects both `kvm_inject_nested_serror()` and the EASE (ARMv8.2-EASE) path in `kvm_inject_nested_sea()`. The fix adds the missing `vcpu_write_sys_reg(vcpu, esr_el2, ESR_EL2)` call for the `except_type_serror` case. No special privileges, authentication, or network access is required—the issue manifests when a nested hypervisor (L2) receives an SError exception. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions in stable trees (linux-5.x, linux-6.x, linux-7.x series)
Timeline
- 2026-09-04: disclosed
- 2026-06-15: patched: Fix authored and committed upstream
- 2026-07-24: other: Backported to stable kernel series