The vulnerability in the Linux kernel’s KVM hypervisor for ARM64 is caused by the fix_host_ownership function not traversing the per‑CPU hyp stack pages, leaving those pages without proper host ownership. This flaw allows a privileged guest or malicious code with control over guest memory to overwrite host memory, potentially leading to privilege escalation or arbitrary code execution on the host. The weakness corresponds to untrusted search path vulnerabilities (CWE‑653).

All Linux kernel builds that enable the KVM hypervisor on ARM64 where the kernel version does not yet contain the patch that updates fix_host_ownership to walk hyp stack pages. No specific version range is enumerated; administrators should verify whether their kernel includes the changes introduced in commits 22df195bff84…, 3a8c562892b9…, or e5dd2a91a7ae3… and apply newer releases accordingly.

The CVSS score is 8.2 and EPSS score is < 1%; the vulnerability is not listed in CISA’s KEV catalog, so the absolute likelihood of exploitation remains low according to the EPSS model. However, because the flaw involves kernel‑level memory ownership within a hypervisor, a local attacker with control over a guest VM—or potentially a remote attacker if the hypervisor is exposed—could craft memory writes that affect host memory, potentially achieving privilege escalation or causing a denial‑of‑service. The attack would require the attacker to have access to guest memory that maps the hyp stack region, making the vector primarily local to the hypervisor environment; remote exploitation would depend on additional weaknesses.