The vulnerability in the Linux kernel’s KVM arm64 code causes a failure in clearing the SVE feature flag when a virtual CPU initialization fails. When this occurs a null SVE state pointer is later used in the guest’s first floating‑point access, leading to a null pointer dereference that can crash the kernel. The impact is a denial of service, potentially rendering the host machine or virtual machines unusable.

All Linux kernel builds that include the KVM arm64 virtualization module are potentially affected. No specific version information is listed in the vendor data, so any kernel using this KVM component for arm64 may contain the flaw until a patch is applied.

With an EPSS score of <1%, the likelihood of exploitation is considered very low. The CVSS score of 6.5 indicates a moderate severity vulnerability. The flaw is an uncontrolled null pointer dereference that could be triggered by an attacker who can induce a virtual CPU initialization failure, such as a malicious guest VM. Based on the description, this is inferred from the fact that the guest’s first FP access uses the NULL sve_state. While there is no record of active exploitation or inclusion in CISA KEV, the potential for a system‑wide crash warrants attention.