KVM for arm64 contains a bug in the __kvm_at_swap_desc() routine where a descriptor address is calculated incorrectly. The code uses (u64 __user *)hva + offset instead of hva + offset, which can cause memory corruption when offset is non‑zero. This flaw could enable an attacker to corrupt kernel memory or execute arbitrary code within the KVM environment, leading to privilege escalation on the host.

The flaw affects the Linux kernel on arm64 for all builds 6.19 and the 7.0 release candidates (rc1 through rc7). It is relevant for any Linux distribution that ships these kernel versions and has KVM enabled.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, implying no known active exploits. Inference: the flaw is in the KVM core and could be triggered by a guest with sufficient privileges or by a local attacker able to manipulate virtual memory offsets. As a result, the risk remains significant for environments running KVM on the affected kernel releases.