This vulnerability is caused by an incorrect mapping of the AArch32 debug register DBGBXVR<n>, which is accessed by a guest virtual machine. When a guest attempts to read or write this register, the kernel selects the wrong backing storage and triggers an unconditional BUG_ON, causing the virtual machine to become dead. The weakness is an improper input validation (CWE-617) that results in a guest crash and loss of service for that VM. No direct impact on the host kernel or other virtual machines is described.

Linux kernels running on the arm64 platform that support KVM with AArch32 guest execution are affected. The vulnerability exists in any kernel release that contains the flawed DBGBXVR<n> handling path; specific version ranges are not listed, so any affected builds on arm64 should be considered at risk.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1 % shows a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. It does not provide privilege escalation or data theft; the documented effect is a guest virtual machine crash. Exploitation would require a guest with the ability to access the debug register, which is the only condition identified in the description.