CVE-2026-63941
Received Received - Intake

KVM: arm64 ZCR_EL2 State Corruption in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor ZCR_EL2 can be updated by a VHE guest hypervisor either using ZCR_EL2 (which traps) or ZCR_EL1 (which does not trap). KVM handles both in different way: - on ZCR_EL2 trap, ZCR_EL2.LEN is immediately capped at the VM's own VL limit. This has the potential to break existing SW that relies on the full LEN field to be stateful. - on ZCR_EL1 access, we do absolutely nothing. On restoring the SVE context for an L2 guest, we directly restore the guest hypervisor's view of ZCR_EL2 into the physical ZCR_EL2. If the guest's view of the register was updated using the ZCR_EL2 accessor, the value has already been sanitised (with the caveat mentioned above). But if the guest used ZCR_EL1, the raw value is written into the HW, and the L2 guest can now access VLs that it shouldn't. Fix all the above by moving the VL capping to the restore points, ensuring that: - the HW is always programmed with a capped value, irrespective of the accessor being used, - the ZCR_EL2.LEN field is always completely stateful, irrespective of the accessor being used. Additionally, move ZCR_EL2 to be a sanitised register, ensuring that only the LEN field is actually stateful. This requires some creative construction of the RES0 mask, as the sysreg generation script does not yet generate RAZ/WI fields. [maz: rewrote commit message, tidy up access_zcr_el2()]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63941
EUVD
EUVD-2026-45714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of the ZCR_EL2 register by a guest hypervisor in KVM for arm64. The issue arises because ZCR_EL2 can be updated via two methods: ZCR_EL2 (trapping) or ZCR_EL1 (non-trapping). The kernel fails to cap the ZCR_EL2.LEN value correctly when updated via ZCR_EL1, allowing a guest hypervisor to set an unrestricted VL (Vector Length) that could grant an L2 guest access to unauthorized vector lengths.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for arm64 systems. Detection requires checking the kernel version and KVM module behavior. Use commands like 'uname -a' to check kernel version and 'lsmod | grep kvm' to verify KVM module status. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow a malicious guest hypervisor to bypass security restrictions and access larger vector lengths than intended. This might lead to unauthorized memory access or privilege escalation within the virtualized environment, potentially compromising the host system or other guests.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific technical issue in the Linux kernel's KVM implementation for arm64 systems. There is no evidence in the provided context that this vulnerability leads to data breaches or unauthorized access that would impact regulatory compliance.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. Update the KVM module and reboot the system. If using a cloud provider or managed service, contact them for patch availability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63941. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart