A vulnerability in the Linux kernel KVM arm64 subsystem could allow a guest hypervisor to bypass security controls, leading to potential host-level impact.

The kernel fails to correctly cap the ZCR_EL2 register provided by a guest hypervisor. A guest hypervisor can manipulate this register using either ZCR_EL2 or ZCR_EL1, bypassing intended restrictions and potentially affecting host system operations.

The ability to manipulate architectural registers from a guest hypervisor presents a significant security risk. With a CVSS score of 8.8, this flaw could allow an attacker to escape the guest environment or impact the host kernel, leading to unauthorized access and potential disruption of all hosted services.

Immediate Action: Update the Linux kernel to version 7.0.12 or apply the provided upstream stable patches immediately.

Proactive Monitoring: Monitor host systems for irregular architectural trap events or unexpected behavior within KVM arm64 environments.

Compensating Controls: Utilize hardware-level security features and ensure that only trusted hypervisors are permitted to run on the infrastructure.

Public Exploit Available: Unknown.

This vulnerability represents a critical risk for arm64-based cloud and virtualization platforms. Organizations must prioritize the deployment of the patched kernel to ensure the integrity of the isolation boundary between guest hypervisors and the host system.