The vulnerability originates in the Linux kernel KVM ARM64 implementation, where the VNCR page is not correctly re-translated after a guest abort for a write. This oversight can cause the kernel to fault on the second write, leading to a system crash. The weakness is tied to improper handling of memory translation and TLB invalidation, which may allow a malicious guest to trigger a kernel fault through crafted abort sequences.

All Linux kernel versions that use the KVM ARM64 VM-ops and the VNCR mechanism are affected. The problem is reported in the kernel source and applies to any system running a Linux kernel that hosts virtual machines on ARM64 hardware.

The CVSS score is 9.3, and the EPSS score is less than 1%, indicating a very low probability of exploitation. It is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. However, attackers who can run code inside a guest VM could exploit the flaw by provoking a write abort on the VNCR, which may trigger a kernel fault. Based on the description, it is inferred that the likely attack vector is a malicious guest VM performing a sequence of reads and writes that exercise the VNCR page in a way that triggers the faulty re-translation logic.