The vulnerability in the Linux kernel’s KVM arm64 code causes a failure in clearing the SVE feature flag when a virtual CPU initialization fails. When this occurs, a null SVE state pointer is later used in the guest’s first floating‑point access, leading to a null pointer dereference that can crash the kernel. The impact is a denial of service, potentially rendering the host machine or virtual machines unusable.

All Linux kernel builds that include the KVM arm64 virtualization module are potentially affected. No specific version information is listed in the vendor data, so any kernel using this KVM component for arm64 may contain the flaw until a patch is applied.

The EPSS score is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The CVSS score is not provided, but the flaw represents an uncontrolled null pointer dereference that could be triggered by an attacker who can induce a virtual CPU initialization failure, such as a malicious guest or by manipulating VM configuration. The lack of exploitation data suggests the risk is moderate, but the potential for a system‑wide crash warrants prompt action.