CVE-2026-23425: KVM: arm64: Fix ID register initialization for non-protected pKVM guests
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix ID register initialization for non-protected pKVM guests
In protected mode, the hypervisor maintains a separate instance of the kvm structure for each VM. For non-protected VMs, this structure is initialized from the host's kvm state.
Currently, pkvminitfeaturesfromhost() copies the KVMARCHFLAGIDREGSINITIALIZED flag from the host without the underlying idregs data being initialized. This results in the hypervisor seeing the flag as set while the ID registers remain zeroed.
Consequently, kvmhasfeat() checks at EL2 fail (return 0) for non-protected VMs. This breaks logic that relies on feature detection, such as ctxthastcrx() for TCR2EL1 support. As a result, certain system registers (e.g., TCR2EL1, PIREL1, POREL1) are not saved/restored during the world switch, which could lead to state corruption.
Fix this by explicitly copying the ID registers from the host kvm to the hypervisor kvm for non-protected VMs during initialization, since we trust the host with its non-protected guests' features. Also ensure KVMARCHFLAGIDREGSINITIALIZED is cleared initially in pkvminitfeaturesfromhost so that vmcopyidregs can properly initialize them and set the flag once done.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel KVM: arm64to a version that resolves this vulnerability.Patch KVM: arm64: Fix ID register initialization for non-protected pKVM guests - Configuration
Clear KVM_ARCH_FLAG_ID_REGS_INITIALIZED initially in pkvm_init_features_from_host so vm_copy_id_regs can properly initialize the host ID registers, then set the flag once the ID registers are explicitly copied and initialized (TCR2_EL1/PIR_EL1/POR_EL1/etc. remain non-zero after init for non-protected pKVM guests).
pkvm_init_features_from_host KVM_ARCH_FLAG_ID_REGS_INITIALIZED = cleared initially then set after vm_copy_id_regs initializes ID registers
Event History
Frequently Asked Questions
Which deployments are exposed?
Systems using KVM on arm64 with protected KVM enabled are the relevant exposure scope, specifically non-protected guests managed in that environment. The issue affects feature detection at EL2 for those non-protected VMs.
What level of attacker access is required?
An attacker needs local access and low privileges, as reflected by the AV:L and PR:L vector. No user interaction is required.
What is the practical impact of the faulty initialization?
The described failure can leave registers such as TCR2_EL1, PIR_EL1, and POR_EL1 unsaved or unrestored during a world switch when the relevant feature detection fails. This may lead to state corruption.
Are mitigations or detection steps documented?
The provided stable-kernel references identify fixes for this issue. If patching cannot be performed immediately, the supplied information does not describe a configuration workaround or detection method.