CVE-2026-23425: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23425 is a Linux kernel vulnerability in the KVM arm64 subsystem affecting ID register initialization for non-protected pKVM guests. The flaw exists in pkvm_init_features_from_host(), which incorrectly copies the KVM_ARCH_FLAG_ID_REGS_INITIALIZED flag from the host without initializing the underlying id_regs data, causing system register state corruption during world switches. Affected versions include Linux kernel 6.14 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1 through 7.0-rc7. It was disclosed on April 3, 2026, with patches released shortly after. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is improper initialization of ID registers in the pKVM hypervisor for non-protected ARM64 virtual machines (CWE not formally assigned). When pkvm_init_features_from_host() copies the KVM_ARCH_FLAG_ID_REGS_INITIALIZED flag from the host kvm structure, it does so without copying the actual id_regs data, leaving those registers zeroed in the hypervisor's copy. This causes kvm_has_feat() checks at EL2 to return 0 (false) for non-protected VMs, breaking feature detection logic such as ctxt_has_tcrx() for TCR2_EL1 support. As a result, system registers including TCR2_EL1, PIR_EL1, and POR_EL1 are not saved or restored during the world switch between host and guest contexts. The attack vector is local, requiring low privileges, and no user interaction is needed (GitHub Advisory).

Exploitation leads to system register state corruption during host-guest context switches on ARM64 systems running pKVM in non-protected mode. Specifically, registers TCR2_EL1, PIR_EL1, and POR_EL1 are not properly saved or restored, which can cause incorrect guest behavior, guest crashes, or unpredictable system instability. The impact is limited to availability (High), with no confidentiality or integrity impact assessed, and the scope is unchanged — meaning the effect is contained to the vulnerable component (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.017% (5th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Patches are available via the Linux kernel stable tree for the affected version ranges. Fixed commits include 7e7c2cf0024d89443a7af52e09e47b1fe634ab17, 858620655c1fbff05997e162fc7d83a3293d5142, and bce3847f7c51b86332bf2e554c9e80ca3820f16c, targeting kernel versions 6.18.17, 6.19.7, and 7.0-rc2 respectively (GitHub Advisory). Amazon Linux 2023 has issued an advisory (ALAS2023-2026-1596), and openSUSE has published a security announcement. If immediate patching is not possible, restricting use of non-protected pKVM guest functionality on ARM64 systems is recommended as a temporary workaround (Feedly).

The vulnerability was announced via the official Linux kernel CVE mailing list (lore.kernel.org) and picked up by standard vulnerability tracking services including ENISA EUVD, VulDB, and INCIBE-CERT. Detection signatures have been added by Nessus (plugin IDs 309153 and 311340) and Qualys (detection ID 762343). No notable independent researcher commentary or significant social media discussion has been observed, consistent with the moderate severity and limited exploitation potential of this flaw.