A flaw in the Linux kernel's KVM arm64 hypervisor allows the host Virtual CPU context to be copied to the hypervisor's private context without ensuring the __hyp_running_vcpu flag is cleared. Because the hypervisor code assumes this flag is null and uses container_of() to resolve the VCPU, a value supplied by the host can be dereferenced at EL2, allowing a malicious guest to alter host state or gain elevated privileges. The vulnerability is reported against the generic Linux kernel. While no specific kernel versions are enumerated, any kernel build that integrates the unpatched KVM code on arm64 is considered vulnerable. The EPSS score of less than 1% and absence from the CISA KEV catalog indicate that exploitation is currently unlikely, yet exploitation would be high‑impact if achieved. It is inferred that the attack vector requires a malicious KVM guest to manipulate host context data, so the vulnerability primarily affects virtualized environments. No public exploits are documented, but the CVSS score of 8.2 reflects the serious privilege escalation potential if an attacker can deliver arbitrary code to a guest VM.

All arm64 Linux kernels that include KVM virtualization are affected until the commit that clears __hyp_running_vcpu after context copying is applied. The vulnerability is reported against the generic Linux kernel. While no specific kernel versions are enumerated, any kernel build that integrates the unpatched KVM code on arm64 is considered vulnerable.

The EPSS score of less than 1% and absence from the CISA KEV catalog indicate that exploitation is currently unlikely, yet exploitation would be high‑impact if achieved. The likely attack vector is a malicious KVM guest that supplies crafted host context data to the hypervisor. This vulnerability involves dereferencing a non‑null __hyp_running_vcpu pointer in the hypervisor, which could lead to alteration of host state and privilege escalation. The CVSS score of 8.2 reflects the severity of this privilege escalation potential.