CVE-2026-64555

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64 architecture, specifically affecting nested virtualization. The kvm_hyp_handle_mops() function, responsible for handling certain virtualization operations, incorrectly restored the SPSR_EL2 register. This occurred because a synthetic value used for nested virtualization was written directly to hardware without proper translation, leading to an improper reset of the single-step state machine. This could potentially impact the stability or security of nested virtualized environments.

This vulnerability is rated as Moderate severity because exploitation requires an authenticated local user within a guest environment on an ARM64 host with nested virtualization active. The issue stems from register desynchronization during exception handling in nested virtualization mode, which can lead to abnormal guest behavior or guest-level denial of service. The impact is confined to virtualized ARM64 guests running under KVM configurations that support nested hypervisors, limiting the blast radius across typical enterprise deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.