A vulnerability in the Linux kernel KVM arm64 hypervisor could allow a local authenticated attacker to achieve full system compromise or escape the virtual machine.

The flaw resides in the kvm_hyp_handle_mops function, which improperly handles state rewinding for MOPS exceptions by failing to translate synthetic state before writing to hardware. This allows an attacker with low privileges, who has access to the local system, to influence the hypervisor state.

The CVSS score of 8.8 reflects the high severity of this issue, as it involves potential scope changes and impacts on confidentiality, integrity, and availability. Successful exploitation could allow a local attacker to break out of a virtualized environment, leading to unauthorized access to the host system, data exfiltration, or complete system disruption. Given the critical nature of kernel-level vulnerabilities, this poses a significant risk to any infrastructure relying on KVM virtualization.

Immediate Action: Update the Linux kernel to version 6.12.97, 6.18.40, 7.1.5, or later, depending on the distribution branch in use.

Proactive Monitoring: Monitor system logs for kernel panics, unexpected hypervisor restarts, or abnormal behavior within guest virtual machines that may indicate attempted exploitation.

Compensating Controls: Restrict local access to systems running KVM virtualization to prevent unauthorized users from executing code that could trigger this kernel-level flaw.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for environments utilizing nested virtualization on arm64 architecture. IT administrators should prioritize patching affected kernel versions as part of their next maintenance cycle to eliminate the possibility of hypervisor compromise. Failure to address this flaw leaves the host system susceptible to attackers who have already gained low-level local access.