PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2026-63941

CVE-2026-63941

kernel: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor

Loading…

Severity

Moderate

Red Hat Product Security

7

CVSS 3.1

Review impact separately from score.

Published · July 19, 2026

Updated · September 24, 2026

Description

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for arm64 architecture. This vulnerability allows a guest hypervisor with Virtualization Host Extensions (VHE) to bypass intended security controls. By manipulating the SVE Control Register (ZCR_EL2) through an untrapped access, a nested guest (L2 guest) can gain unauthorized access to Vector Lengths (VLs), potentially leading to information disclosure.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-266 · Incorrect Privilege Assignment