Executive brief
The Linux kernel's ARM64 architecture code reads a CPU hardware register (GMID_EL1) even when MTE (Memory Tagging Extension) is disabled, triggering an undefined instruction exception in virtualized environments like pKVM. This causes a kernel panic when CPUs are brought offline and back online, disrupting system availability.
Technical details
The vulnerability is a conditional logic flaw in __cpuinfo_store_cpu() that gates the GMID_EL1 register read only on the raw ID_AA64PFR1_EL1 value, ignoring the kernel's CONFIG_ARM64_MTE configuration or arm64.nomte command-line override. When MTE is disabled but the hardware reports support, KVM's pKVM sets HCR_EL2.TID5 to trap access, causing the host to receive an undefined instruction exception. The flaw manifests only in pKVM after CPU hotplug (offline/online cycles) when CPU_ON relay sets HCR before the CPU reaches EL1. The fix adds a gmid_el1_accessible() function that gates the read on both CONFIG_ARM64_MTE and the effective MTE feature bits (accounting for command-line overrides and boot-CPU safety), preventing the illegal register access.
Affected products
- Linux Linux Kernel 5.x, 6.x, 7.x (ARM64 architecture with MTE disabled)
Timeline
- 2026-09-16: disclosed
- 2026-09-03: patched: Upstream fix committed by Will Deacon