CVE-2026-80873

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component on ARM64 systems. When a nested guest hypervisor (L2) encounters a System Error (SError) exception, the ESR_EL2 register, which provides details about the exception, is not properly updated. This can cause the guest L2 hypervisor to observe outdated exception information, potentially leading to incorrect error handling or instability within the virtualized environment.

This vulnerability is classified as Low severity because exploitation requires a specialized ARM64 nested virtualization setup where an unprivileged guest hypervisor triggers asynchronous system errors. In typical Red Hat deployments, nested virtualization on ARM64 is not enabled by default and requires explicit hardware capabilities and configuration. The impact is confined to delivering outdated error syndrome information to the intermediate guest hypervisor, resulting in guest-level instability without compromising host confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.