CVE-2026-80873: KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Write ESREL2 for injected nested SError exceptions
kvminjectel2exception() writes ESREL2 for synchronous exceptions but not for SError. enterexception64() does not write ESRELx for any exception type, so the constructed syndrome is dropped. A guest L2 hypervisor taking a nested SError observes stale ESREL2.
This affects both kvminjectnestedserror() and the EASE path in kvminjectnestedsea().
Write ESREL2 for excepttypeserror, matching excepttypesync.
Affected Software
Event History
Frequently Asked Questions
Which environments are affected?
The issue applies to Linux kernel deployments using KVM on arm64 with nested virtualization, where an L2 guest hypervisor can receive injected nested SError exceptions. Both kvm_inject_nested_serror() and the EASE path in kvm_inject_nested_sea() are affected.
What would indicate that this issue is present?
An L2 guest hypervisor handling a nested SError may observe a stale ESR_EL2 value rather than the syndrome constructed for that exception. The problem occurs because ESR_EL2 is not written for injected SError exceptions.