The vulnerability originates from incorrect gating of fine‑grained UNDEF traps in the ARM64 KVM subsystem. Because the kernel mistakenly applied these traps even when the FEAT_FGT hardware feature was absent, a guest executing a TLBI OS operation at vEL1 could receive an undefined instruction trap. The kernel’s handler receives a TLBI request that is not expected in that context, resulting in a spurious WARN and it is inferred that the kernel may crash. The flaw does not provide direct code execution or data disclosure, but it can destabilize guest workloads, leading to a denial of service of the virtual machine (inferred from the crash).

All Linux kernel implementations that include KVM support for ARM64 architectures are affected, specifically any kernel build prior to the integration of the patch commit 1113374a17d7f7d16b02ee0bbd9b1e7a60cbb087. The vulnerability applies to the upstream Linux distribution (Linux:Linux) and to any derivative that incorporates the upstream source without the patch.

The CVSS score of 6.5 denotes moderate severity, while the EPSS score of <1% signals a low probability of exploitation. The issue is absent from the CISA KEV catalog, further indicating limited real‑world exploitation. The weakness is a local hypervisor configuration and configuration‑driven error; an attacker would need privileged access on the host or the ability to manipulate KVM settings to trigger the defect. Based on the description, it is inferred that the attack would require direct interaction with the host kernel—such as an attacker already positioned inside the hypervisor or with root privileges—to alter the trap configuration. The expected outcome is a guest‑level denial of service rather than a full host compromise (inferred from the crash and lack of host impact).