CVE-2026-23425

Vulnerability

Overview

In the Linux kernel's KVM/arm64 subsystem, a flaw in the initialization of non-protected pKVM guests leads to feature-detected missing ID register data. When pkvm_init_features_from_host() copies the KVM_ARCH_FLAG_ID_REGS_INITIALIZED flag from the host, it does so that the hypervisor erroneously considers the ID registers as initialized—even though they remain zeroed. This causes kvm_has_feat() checks at EL2 to incorrectly return 0 for critical CPU features.

Attack

Vector & Exploitation

An attacker controlling a non-protected pKVM guest could exploit this bug to bypass EL2 feature checks. Since the ID registers are zeroed, the hypervisor believes certain architectural features are absent. The attack requires the ability to run a VM in non-protected pKVM mode. No special privileges beyond that are needed; the guest can simply exercise system registers that rely on correct feature detection.

Impact

Without proper feature detection, the hypervisor fails to save/restore registers such as TCR2_EL1, PIR_EL1, and POR_EL1 during world switches. This can lead to guest state corruption or unintended exposure of hypervisor state, potentially allowing a guest to crash the system or escalate privileges. The CVSS v3 score of 8.8 (High) reflects the risk of confidentiality, integrity, and availability loss.

Mitigation

The fix explicitly copies the host's ID registers to the hypervisor structure for non-protected VMs and clears the initialized flag until the copy is complete. Patches are available in the stable kernel trees [1][2][3]. All users running protected pKVM (which is the typical in Android or confidential computing deployments) should apply the updates as soon as possible.