In the Linux kernel’s ARM64 KVM implementation, a guest hypervisor can write the ZCR_EL2 vector‑length register via the ZCR_EL1 interface without proper bounds checking. When the host restores a level‑2 guest’s SVE context, the raw value supplied by the guest is written straight into the hardware register. This permits the guest to access vector lengths that exceed the host’s configured limits, violating host‑guest isolation and effectively allowing the guest hypervisor to override the host’s vector‑length configuration. The flaw demonstrates improper input validation (CWE‑20).

All ARM64 Linux kernels that include KVM with Virtualisation Host Extensions (VHE) and have not applied the patch commits 742a9b5c or 8372633 are affected. This encompasses generic Linux kernel releases for ARM64 from any vendor that ship a vulnerable kernel image; no vendor‑specific products are listed beyond the generic Linux kernel for ARM64.

The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score of less than 1% points to a low current exploitation probability. The vulnerability is not listed in CISA’s KEV, so no widespread attacks are known. The likely attack vector is from within a virtualised environment where a guest hypervisor with VHE capabilities writes to ZCR_EL1 to manipulate the host’s vector‑length register. While exploitation is constrained to environments that run such a guest, the high severity and insufficient mitigation make the flaw actionable and warrant prompt countermeasures.