This bug is a flaw in the ARM64 Linux kernel’s boot code where writes to the PMZr_EL0 register are not correctly trapped when the system is running in EL2. Because the trap bit for PMZr_EL0 never gets set, a write originating from user space can be delivered to the hypervisor domain and trigger a BUG() without producing a panic message, bringing the host down. The vulnerability can thus be used to crash the system, potentially allowing a malicious user process to cause downtime or disrupt services.

All versions of the Linux kernel that run on ARM64 devices and contain this unpatched boot code are affected. The kernel version information is not specified in the advisory, so any arm64 kernel prior to the patch that introduces the proper trap handling is considered vulnerable.

The CVSS score is not provided and the EPSS score is unavailable, but the bug is not listed in the CISA KEV catalog. The likely attack vector is local, requiring a user-space process that is allowed to write to PMZr_EL0 (e.g., via the perf interface when kernel.perf_user_access is set to 1). An attacker with such privileges could trigger a host crash without the system generating a typical panic or diagnostic output, making detection harder.