Affected Systems

Linux kernel ARM64 KVM code with nested virtualization enabled. Affected versions: 6.17 through 6.18.50, 7.0 through 7.2.4, and 7.3-rc pre-releases. Fixed in 6.18.51, 7.2.5, and 7.3-rc1. Requires Armv8.4 hardware with FEAT_NV2 feature and nested virtualization boot-time flag (off by default). Red Hat Enterprise Linux 10 affected; RHEL 6-9 not affected. Ubuntu 26.04 and certain hardware-enablement kernels vulnerable; 24.04 LTS base kernel not affected.

Exploitation Status

No public exploit code available. No evidence of active exploitation. Researcher demonstrated proof-of-concept capability for guest escape to host. CISA KEV catalog does not list this CVE as of September 22, 2026. Predicted exploitation score below 1%.

Business Impact

Guest VMs can read and write host kernel memory due to skipped TLB invalidation when memory is arranged in specific patterns, enabling escape from VM to host and arbitrary code execution. Attack requires local access (guest VM or local user with /dev/kvm access) and nested virtualization enabled on ARM64 host. Major cloud providers (AWS, Google Cloud) do not expose vulnerable configuration in standard ARM offerings—AWS nested virtualization uses Intel only, GCP excludes ARM from nested virtualization. Secondary risk: local privilege escalation to root on systems where /dev/kvm is world-accessible (e.g., RHEL 10 default). CVSS scores range 7.8 to 9.3 depending on vendor assessment of exploitation difficulty.

Urgency

🟡 Within a week

Recommended Actions

  • Patch ARM64 Linux hosts to kernel 6.18.51, 7.2.5, or 7.3-rc1 or later, prioritizing systems with nested virtualization enabled
  • Audit ARM64 KVM hosts to identify which have nested virtualization enabled (check boot parameters for nv=1 or equivalent ARM64 nested virt flags)
  • On Red Hat Enterprise Linux 10 systems, restrict /dev/kvm permissions to trusted users only until patched (chmod 600 /dev/kvm or use udev rules)
  • For unpatched hosts requiring nested virtualization, disable the feature at boot time as temporary mitigation if operationally feasible
  • Monitor kernel logs and VM behavior for unexpected memory access patterns or TLB-related anomalies on ARM64 hypervisors running 6.17+ kernels