HIGH
kvm IDRegs Corruption
CVE-2026-23425
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the `kvm` structure for each VM. For non-protected VMs, this structure is initialized from the host's `kvm` state. Currently, `pkvm_init_features_from_host()` copies the `KVM_ARCH_FLAG_ID_REGS_INITIALIZED` flag from the host without the underlying `id_regs` data being initialized. This results in the hypervisor seeing the flag as set while the ID registers remain zeroed. Consequently, `kvm_has_feat()` checks at EL2 fail (return 0) for non-protected VMs. This breaks logic that relies on feature detection, such as `ctxt_has_tcrx()` for TCR2_EL1 support. As a result, certain system registers (e.g., TCR2_EL1, PIR_EL1, POR_EL1) are not saved/restored during the world switch, which could lead to state corruption. Fix this by explicitly copying the ID registers from the host `kvm` to the hypervisor `kvm` for non-protected VMs during initialization, since we trust the host with its non-protected guests' features. Also ensure `KVM_ARCH_FLAG_ID_REGS_INITIALIZED` is cleared initially in `pkvm_init_features_from_host` so that `vm_copy_id_regs` can properly initialize them and set the flag once done.
02KernelScan AI Analysis
Risk summary
Non-protected KVM guests on ARM64 systems may experience system register state corruption due to improper ID register initialization. This affects virtualized environments where guest VMs rely on proper CPU feature detection and register save/restore operations during context switches.
Vulnerability analysis
The root cause is in pkvm_init_features_from_host() which copies the KVM_ARCH_FLAG_ID_REGS_INITIALIZED flag from the host without copying the actual id_regs data, leaving ID registers zeroed while the flag indicates they are initialized. This causes kvm_has_feat() checks to fail at EL2 for non-protected VMs, breaking feature detection logic like ctxt_has_tcrx() for TCR2_EL1 support. The fix adds explicit copying of ID registers from host to hypervisor kvm structure for non-protected VMs and ensures proper flag management during initialization. Attack surface is local, requiring VM creation privileges on ARM64 systems with KVM.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.18 | 6.18.17 | bce3847f7c51 |
| 6.19 | 6.19.7 | 858620655c1f |
| mainline | 7.0 | 7e7c2cf0024d |