Linux Kernel KVM Vulnerability Affecting ARM64 Products

CVE-2026-80873

What is CVE-2026-80873?

A vulnerability in the Linux kernel KVM component affects ARM64 systems by failing to write the correct exception syndrome for injected nested SError exceptions. Specifically, the function 'kvm_inject_el2_exception()' does not appropriately populate 'ESR_EL2' during synchronous exceptions, leading to potential security issues in a guest L2 hypervisor. This oversight can result in the observation of stale 'ESR_EL2' values, compromising the integrity of nested exception handling. Proper exception handling is critical in hypervisor environments to ensure system stability and security.

References