In the Linux kernel's ARM64 KVM implementation, the ZCR_EL2 vector‑length register can be written by a guest hypervisor using the ZCR_EL1 interface without proper bounds checking. When the host restores a level‑2 guest's SVE context, the raw value written by the guest is copied directly into the hardware register. Consequently, the guest can access vector lengths that exceed the host’s configured limits, violating the intended protection of the vector‑length field. This flaw effectively allows a privileged guest hypervisor to alter the state of the host’s vector‑length configuration, potentially granting it higher privileges than intended. The weakness is an example of improper privilege management (CWE‑266).

All ARM64 Linux kernels that include KVM with Virtualisation Host Extensions (VHE) and have not incorporated the patch commits 742a9b5c/8372633 are affected. This includes generic Linux kernel releases from any vendor that ship a vulnerable kernel image; no vendor‑specific products are listed beyond the generic Linux kernel for ARM64.

The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score of less than 1% points to a low current exploitation probability. The vulnerability is not listed in CISA’s KEV, so no widespread attacks are known. The likely attack vector is from within a virtualised environment where a guest hypervisor with VHE capabilities writes to ZCR_EL1 to manipulate the host’s vector‑length register. While exploitation is constrained to environments that run such a guest, the high severity and insufficient mitigation make the flaw actionable and warrant prompt countermeasures.