The vulnerability resides in the Linux kernel’s KVM subsystem for ARM64. A host that sets the GUEST_HAS_SVE flag without enabling the corresponding SVE feature bit can create a virtual CPU that carries a NULL sve_state. During a world switch this NULL state is read, causing a kernel fault that typically results in a crash. The effect is a denial of service for the host operating system and can potentially lead to a loss of control over all virtual machines running on that host. The weakness stems from improper handling of a feature flag versus a hardware state bit, leading to a null pointer dereference during state initialization.

This flaw affects all Linux kernel installations that run KVM on ARM64 architecture. The problematic code is present in the kernel versions that have not yet incorporated the patch referenced in the provided commit URLs. No specific product line is listed, but generic Linux kernel distributions on ARM64 are vulnerable until updated to a kernel release that applies the fix.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the host to set the GUEST_HAS_SVE flag without the corresponding SVE feature bit, creating a virtual CPU with a NULL sve_state that causes a kernel fault during a world switch. A local attacker with kernel privileges could exploit this configuration misstep, leading to a denial of service via kernel crash. Because exploitation depends on a host-side configuration error rather than a remote exploit, widespread exploitation is unlikely, but the impact on affected hosts is significant.