In Linux kernel arm64 KVM, an unknown IOCTL number sent from user space triggers the generic ioctl handler to call a helper that warns when the opcode is not recognised. When the system is running with panic_on_warn enabled, this warning escalates to a kernel panic, crashing the host. The flaw arises because the input from the user is not validated before leading to a fatal kernel state, resulting in a denial‑of‑service condition.

The vulnerability impacts Linux kernel builds that include the arm64 KVM module and have not yet incorporated the upstream patch that guards against unknown ioctl opcodes. All arm64 KVM implementations where the kernel’s vmlinux does not contain the commits identified by 49d9d295d69d07e850cae35933ba8519e2915f26 and cc53eb5c6515e3221314624a22c9da9c80a67f63 are affected. The specific kernel versions are not listed in the CVE data; administrators should verify whether their kernel includes these fixes or consult the changelog for the appropriate patch level.

With a CVSS score of 4.7, the vulnerability has a moderate overall severity. The EPSS score indicates a very low exploitation probability (< 1%), and it is not listed in the CISA KEV catalog. Exploitation still requires an attacker with the ability to send arbitrary ioctl requests to /dev/kvm, which can be performed locally or remotely if the device is exposed. On systems with panic_on_warn enabled, an unknown ioctl such as 0xdeadbeef will trigger a kernel panic, causing a denial‑of‑service. Given the low likelihood of exploitation but the severe impact of a kernel panic, the risk is significant in environments where KVM is exposed to untrusted workloads or when panic_on_warn is active.