A flaw in the Linux kernel’s KVM arm64 subsystem misinterprets a translation error: the handler for VNCR aborts assumes that a negative return value from the kvm_translate_vncr() function signals an abort, even when it does not. This incorrect assumption allows a specially crafted guest memory access to inject a Secure Exception Abort (SEA) into the host, bypassing normal page‑fault handling and potentially enabling the execution of privileged code or corruption of kernel state.

All Linux kernel implementations for arm64 that include the buggy kvm_translate_vncr() code before the patch commit are susceptible. The vulnerability affects the generic Linux kernel used for KVM hosts; no specific version ranges are listed, so any kernel in use until the fix is applied is considered vulnerable.

No CVSS or EPSS score is reported, and the vulnerability is not listed in the KEV catalog, indicating limited publicly known exploitation. However, the flaw resides in a kernel path that can be exercised by a guest able to manipulate memory mappings. Consequently, the risk is high for hosts that run untrusted guests but lower for hardened deployments that isolate or disable KVM. The exploit requires precise control over virtual memory translation and is not trivially achievable, but the potential impact of privilege escalation is significant once achieved.