CVE-2026-64555: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64555 is a state translation flaw in the Linux kernel's KVM subsystem for ARM64 nested virtualization, specifically in the kvm_hyp_handle_mops() function. The vulnerability arises because the function fails to properly translate the synthetic vEL2 CPU state (via vcpu_cpsr()) before writing it to the hardware SPSR_EL2 register when handling MOPS (Memory Operations) exceptions. Affected Linux kernel versions begin at 6.7 and are fixed in 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. The CVE was published on July 27, 2026, and NVD has not yet assigned a CVSS score; Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is an improper state synchronization issue (no CWE has been formally assigned by NVD yet) in arch/arm64/kvm/hyp/include/hyp/switch.h. When kvm_hyp_handle_mops() resets the single-step state machine during a MOPS exception rewind, it modifies vcpu_cpsr() — a synthetic value used internally by KVM to represent vEL2 state — and writes it directly to hardware without the required translation step. In nested virtualization scenarios, this synthetic value does not map directly to the hardware SPSR_EL2 register, resulting in CPU control state corruption. The fix bypasses the synthetic state entirely by directly modifying SPSR_EL2, which is then resynchronized on the next full exit to KVM (GitHub Advisory, Feedly).

A local user with code execution capability inside a KVM guest VM on an ARM64 system with nested virtualization enabled can exploit this flaw to corrupt CPU control state (SPSR_EL2), potentially leading to arbitrary code execution at the hypervisor level or a hypervisor crash. This could compromise the integrity and availability of the host system and all co-hosted guest VMs. Confidentiality impact is possible if hypervisor-level code execution is achieved, enabling access to memory across guest boundaries (Feedly).

Update the Linux kernel to a patched version: 6.12.97 or later (6.12.x branch), 6.18.40 or later (6.18.x branch), 7.1.5 or later (7.1.x branch), or 7.2-rc4 and above. The fix is applied to arch/arm64/kvm/hyp/include/hyp/switch.h via commits 10a568010e82, 884b44256041, dd3b237eb778, and ff1022c3de46. As a workaround, organizations that do not require nested virtualization on ARM64 systems should disable this feature to eliminate the attack surface (GitHub Advisory, Feedly).