A critical vulnerability in the Linux kernel KVM arm64 subsystem allows local attackers to trigger improper TLB invalidation, posing a significant risk of system compromise.

The vulnerability exists in the pgshift_level_to_ttl function within the KVM arm64 hypervisor code, where negative S1 walk levels are improperly handled. This error causes the system to miscalculate TLB invalidation sizes, which can be triggered by an attacker with local access to the system.

This vulnerability carries a CVSS score of 9.3, classifying it as critical. Successful exploitation allows a local attacker to potentially gain elevated privileges, cause system crashes, or execute arbitrary code within the context of the host kernel. Such an event would result in full system compromise, loss of data integrity, and significant operational downtime for affected server infrastructure.

Immediate Action: Apply the latest security patches provided by your Linux distribution maintainers, ensuring the kernel is updated to at least version 6.18.51 or 7.2.5.

Proactive Monitoring: Monitor system logs for unusual kernel panic events or repeated KVM-related errors that may indicate an exploitation attempt.

Compensating Controls: Restrict local access to systems running KVM virtualization to authorized personnel only, as the attack vector requires local execution capability.

Public Exploit Available: Unknown

The severity of this flaw cannot be overstated, particularly in environments utilizing KVM for multi-tenant virtualization. Administrators must prioritize updating the Linux kernel across all affected nodes to the specified fixed versions immediately to mitigate the risk of host-level compromise. Failure to patch these systems leaves them vulnerable to local attackers seeking to escape virtualized containers or elevate privileges to the kernel level.