CVE-2026-23425 (GCVE-0-2026-23425)

Vulnerability from cvelistv5 – Published: 2026-04-03 13:24 – Updated: 2026-05-11 22:06
VLAI
Title
KVM: arm64: Fix ID register initialization for non-protected pKVM guests
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the `kvm` structure for each VM. For non-protected VMs, this structure is initialized from the host's `kvm` state. Currently, `pkvm_init_features_from_host()` copies the `KVM_ARCH_FLAG_ID_REGS_INITIALIZED` flag from the host without the underlying `id_regs` data being initialized. This results in the hypervisor seeing the flag as set while the ID registers remain zeroed. Consequently, `kvm_has_feat()` checks at EL2 fail (return 0) for non-protected VMs. This breaks logic that relies on feature detection, such as `ctxt_has_tcrx()` for TCR2_EL1 support. As a result, certain system registers (e.g., TCR2_EL1, PIR_EL1, POR_EL1) are not saved/restored during the world switch, which could lead to state corruption. Fix this by explicitly copying the ID registers from the host `kvm` to the hypervisor `kvm` for non-protected VMs during initialization, since we trust the host with its non-protected guests' features. Also ensure `KVM_ARCH_FLAG_ID_REGS_INITIALIZED` is cleared initially in `pkvm_init_features_from_host` so that `vm_copy_id_regs` can properly initialize them and set the flag once done.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 41d6028e28bd474298ff10409c292ec46cf43a90 , < bce3847f7c51b86332bf2e554c9e80ca3820f16c (git)
Affected: 41d6028e28bd474298ff10409c292ec46cf43a90 , < 858620655c1fbff05997e162fc7d83a3293d5142 (git)
Affected: 41d6028e28bd474298ff10409c292ec46cf43a90 , < 7e7c2cf0024d89443a7af52e09e47b1fe634ab17 (git)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/hyp/nvhe/pkvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bce3847f7c51b86332bf2e554c9e80ca3820f16c",
              "status": "affected",
              "version": "41d6028e28bd474298ff10409c292ec46cf43a90",
              "versionType": "git"
            },
            {
              "lessThan": "858620655c1fbff05997e162fc7d83a3293d5142",
              "status": "affected",
              "version": "41d6028e28bd474298ff10409c292ec46cf43a90",
              "versionType": "git"
            },
            {
              "lessThan": "7e7c2cf0024d89443a7af52e09e47b1fe634ab17",
              "status": "affected",
              "version": "41d6028e28bd474298ff10409c292ec46cf43a90",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/hyp/nvhe/pkvm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix ID register initialization for non-protected pKVM guests\n\nIn protected mode, the hypervisor maintains a separate instance of\nthe `kvm` structure for each VM. For non-protected VMs, this structure is\ninitialized from the host\u0027s `kvm` state.\n\nCurrently, `pkvm_init_features_from_host()` copies the\n`KVM_ARCH_FLAG_ID_REGS_INITIALIZED` flag from the host without the\nunderlying `id_regs` data being initialized. This results in the\nhypervisor seeing the flag as set while the ID registers remain zeroed.\n\nConsequently, `kvm_has_feat()` checks at EL2 fail (return 0) for\nnon-protected VMs. This breaks logic that relies on feature detection,\nsuch as `ctxt_has_tcrx()` for TCR2_EL1 support. As a result, certain\nsystem registers (e.g., TCR2_EL1, PIR_EL1, POR_EL1) are not\nsaved/restored during the world switch, which could lead to state\ncorruption.\n\nFix this by explicitly copying the ID registers from the host `kvm` to\nthe hypervisor `kvm` for non-protected VMs during initialization, since\nwe trust the host with its non-protected guests\u0027 features. Also ensure\n`KVM_ARCH_FLAG_ID_REGS_INITIALIZED` is cleared initially in\n`pkvm_init_features_from_host` so that `vm_copy_id_regs` can properly\ninitialize them and set the flag once done."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:06:39.575Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bce3847f7c51b86332bf2e554c9e80ca3820f16c"
        },
        {
          "url": "https://git.kernel.org/stable/c/858620655c1fbff05997e162fc7d83a3293d5142"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e7c2cf0024d89443a7af52e09e47b1fe634ab17"
        }
      ],
      "title": "KVM: arm64: Fix ID register initialization for non-protected pKVM guests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23425",
    "datePublished": "2026-04-03T13:24:33.384Z",
    "dateReserved": "2026-01-13T15:37:46.015Z",
    "dateUpdated": "2026-05-11T22:06:39.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23425",
      "date": "2026-07-24",
      "epss": "0.00119",
      "percentile": "0.0209"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23425\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-03T14:16:28.747\",\"lastModified\":\"2026-07-21T19:10:00.107\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Fix ID register initialization for non-protected pKVM guests\\n\\nIn protected mode, the hypervisor maintains a separate instance of\\nthe `kvm` structure for each VM. For non-protected VMs, this structure is\\ninitialized from the host\u0027s `kvm` state.\\n\\nCurrently, `pkvm_init_features_from_host()` copies the\\n`KVM_ARCH_FLAG_ID_REGS_INITIALIZED` flag from the host without the\\nunderlying `id_regs` data being initialized. This results in the\\nhypervisor seeing the flag as set while the ID registers remain zeroed.\\n\\nConsequently, `kvm_has_feat()` checks at EL2 fail (return 0) for\\nnon-protected VMs. This breaks logic that relies on feature detection,\\nsuch as `ctxt_has_tcrx()` for TCR2_EL1 support. As a result, certain\\nsystem registers (e.g., TCR2_EL1, PIR_EL1, POR_EL1) are not\\nsaved/restored during the world switch, which could lead to state\\ncorruption.\\n\\nFix this by explicitly copying the ID registers from the host `kvm` to\\nthe hypervisor `kvm` for non-protected VMs during initialization, since\\nwe trust the host with its non-protected guests\u0027 features. Also ensure\\n`KVM_ARCH_FLAG_ID_REGS_INITIALIZED` is cleared initially in\\n`pkvm_init_features_from_host` so that `vm_copy_id_regs` can properly\\ninitialize them and set the flag once done.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nKVM: arm64: Correcci\u00f3n de la inicializaci\u00f3n de registros ID para invitados pKVM no protegidos\\n\\nEn modo protegido, el hipervisor mantiene una instancia separada de la estructura \u0027kvm\u0027 para cada VM. Para VMs no protegidas, esta estructura se inicializa a partir del estado \u0027kvm\u0027 del host.\\n\\nActualmente, \u0027pkvm_init_features_from_host()\u0027 copia el flag \u0027KVM_ARCH_FLAG_ID_REGS_INITIALIZED\u0027 del host sin que los datos subyacentes de \u0027id_regs\u0027 se inicialicen. Esto resulta en que el hipervisor ve el flag como establecido mientras los registros ID permanecen a cero.\\n\\nConsecuentemente, las comprobaciones de \u0027kvm_has_feat()\u0027 en EL2 fallan (devuelven 0) para VMs no protegidas. Esto rompe la l\u00f3gica que depende de la detecci\u00f3n de caracter\u00edsticas, como \u0027ctxt_has_tcrx()\u0027 para el soporte de TCR2_EL1. Como resultado, ciertos registros del sistema (p. ej., TCR2_EL1, PIR_EL1, POR_EL1) no se guardan/restauran durante el world switch, lo que podr\u00eda llevar a la corrupci\u00f3n del estado.\\n\\nEsto se soluciona copiando expl\u00edcitamente los registros ID del \u0027kvm\u0027 del host al \u0027kvm\u0027 del hipervisor para VMs no protegidas durante la inicializaci\u00f3n, ya que confiamos en el host con las caracter\u00edsticas de sus invitados no protegidos. Tambi\u00e9n se debe asegurar que \u0027KVM_ARCH_FLAG_ID_REGS_INITIALIZED\u0027 se borre inicialmente en \u0027pkvm_init_features_from_host\u0027 para que \u0027vm_copy_id_regs\u0027 pueda inicializarlos correctamente y establecer el flag una vez terminado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/kvm/hyp/nvhe/pkvm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"41d6028e28bd474298ff10409c292ec46cf43a90\",\"lessThan\":\"bce3847f7c51b86332bf2e554c9e80ca3820f16c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41d6028e28bd474298ff10409c292ec46cf43a90\",\"lessThan\":\"858620655c1fbff05997e162fc7d83a3293d5142\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41d6028e28bd474298ff10409c292ec46cf43a90\",\"lessThan\":\"7e7c2cf0024d89443a7af52e09e47b1fe634ab17\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/kvm/hyp/nvhe/pkvm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.17\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.7\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14.1\",\"versionEndExcluding\":\"6.18.17\",\"matchCriteriaId\":\"9C726C48-356A-4304-8BC9-6D68C8757131\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.7\",\"matchCriteriaId\":\"69245D10-0B71-485E-80C3-A64F077004D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"7DE421BA-0600-4401-A175-73CAB6A6FB4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7e7c2cf0024d89443a7af52e09e47b1fe634ab17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/858620655c1fbff05997e162fc7d83a3293d5142\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bce3847f7c51b86332bf2e554c9e80ca3820f16c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:20:55+00:00",
      "cve": "CVE-2026-23425",
      "id": "CVE-2026-23425",
      "initial_release_date": "2026-04-03T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: arm64: Fix ID register initialization for non-protected pKVM guests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23425.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T05:28:37Z",
      "cve": "CVE-2026-23425",
      "id": "CVE-2026-23425",
      "initial_release_date": "2026-04-03T23:28:07Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "401",
      "product_status:known_not_affected": "302",
      "product_status:recommended": "145",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23425",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23425.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.