A flaw in the KVM arm64 hypervisor path copies the host's vGIC state into a private hypervisor vCPU on every run. The field used_lrs is treated as the loop bound for saving and restoring the vGIC list registers, but the code fails to clamp or validate it. An attacker can supply a value larger than the number of implemented list registers, causing the hypervisor to index vgic_lr[] beyond its bounds and read or write the host's ICH_LR<n>_EL2 registers. This unchecked array indexing can corrupt hypervisor data structures and potentially give the attacker privilege escalation or remote code execution within the hypervisor context.

Any Linux kernel that contains the unpatched KVM arm64 hypervisor code referenced by the commit series c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8 through c/c646431865f4b1a5b14067233fa27b11e05e0d46. The vulnerability affects all kernel variants per the CPE string and is present in distributions that ship kernels without the patch release; specific version numbers are not listed in the data.

The EPSS score is below 1%, indicating a low probability of exploitation as of the current data, and the vulnerability is not listed in CISA’s KEV catalog. The flaw creates unchecked array indexing in a privileged hypervisor component, which could lead to memory corruption and potentially privilege escalation or remote code execution. Based on the description, it is inferred that an attacker would need to influence the host’s vGIC state during a KVM arm64 hypervisor flush, but the specific exploitation conditions are not detailed in the advisory. Therefore, the exact threat level depends on the environment’s exposure to such manipulation.