The Linux kernel for ARM64 allows a nested KVM guest to write to the ZCR_EL2 system register alias. This write triggers a bogus warning that, while hypervisor vectors are installed, can cause a hyp_panic and crash the host. The result is a denial of service to all virtual machines and services running on the host, representing a flaw in exception handling.

Linux kernels running on ARM64 hosts with KVM and FEAT_NV2 enabled are affected. Any kernel revision that has not incorporated the patches from commits 5000bcae71c, 6561597dba, 7deadbc5da, or 9f1667098c remains vulnerable. Recent kernel builds lacking these changes should be considered for impact assessment. No specific affected version information is identified in the CVE data.

The CVSS score of 7.1 indicates moderate severity, while an EPSS score of < 1% suggests a low probability of exploitation today. The vulnerability is not listed in CISA KEV. Exploitation requires a guest that can perform a write to ZCR_EL2 in a nested virtualization scenario, and that the host advertises FEAT_NV2. A successful exploit immediately crashes the host, providing local denial of service. The attack vector is therefore a privileged guest VM executing a specific privileged instruction in a nested context.