CVE-2026-23425
KVM ARM64 ID Register Initialization Bug Causes State Corruption
Publication date: 2026-04-03
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.14 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.14.1 (inc) to 6.18.17 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's KVM implementation for arm64 architecture, specifically affecting non-protected pKVM guests. The issue arises because the hypervisor incorrectly copies a flag indicating that ID registers have been initialized from the host without actually initializing the underlying ID register data. As a result, the hypervisor believes the ID registers are ready when they are actually zeroed.
This causes feature detection checks at the EL2 exception level to fail for non-protected VMs, breaking logic that depends on these features. Consequently, certain system registers such as TCR2_EL1, PIR_EL1, and POR_EL1 are not properly saved or restored during context switches between virtual machines, which can lead to state corruption.
The fix involves explicitly copying the ID registers from the host to the hypervisor for non-protected VMs during initialization and properly managing the initialization flag to ensure the registers are correctly set up.
How can this vulnerability impact me? :
This vulnerability can lead to state corruption in non-protected virtual machines running on the affected Linux kernel. Because certain system registers are not saved and restored correctly during VM context switches, the virtual machines may behave unpredictably or experience errors.
Such state corruption could potentially cause instability or crashes in virtualized environments, impacting the reliability and security of systems relying on KVM for virtualization on arm64 platforms.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by fixing the initialization of the ID registers for non-protected pKVM guests in the Linux kernel's KVM arm64 code.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix, which ensures proper copying and initialization of ID registers for non-protected VMs.