CVE-2026-63941: Linux Kernel Privilege Escalation Flaw

CVE-2026-63941 Overview

CVE-2026-63941 is a Linux kernel vulnerability in the arm64 Kernel-based Virtual Machine (KVM) subsystem. The flaw affects how KVM handles the ZCR_EL2 system register when a Virtualization Host Extensions (VHE) guest hypervisor updates Scalable Vector Extension (SVE) vector length state. KVM correctly caps ZCR_EL2.LEN on trapped ZCR_EL2 accesses but performs no capping when the guest writes ZCR_EL1, which does not trap. On SVE context restore for an L2 guest, the unsanitised value is written directly to hardware. This allows a nested guest to access SVE vector lengths beyond the configured limit.

Critical Impact
A local L2 guest running under a VHE guest hypervisor can bypass SVE vector length restrictions, breaching virtualization isolation boundaries.

Affected Products

Linux kernel arm64 KVM subsystem with nested virtualization support
Systems using VHE-enabled guest hypervisors with SVE
Kernel versions prior to commits 742a9b5 and 8372633

Discovery Timeline

2026-07-19 - CVE-2026-63941 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63941

Vulnerability Analysis

The vulnerability resides in the arm64 KVM code path that restores SVE state for an L2 guest running under a VHE guest hypervisor. ZCR_EL2 controls the effective SVE vector length at EL2. A VHE guest hypervisor can modify this state through two register accessors: ZCR_EL2, which traps into the host hypervisor, and ZCR_EL1, which does not trap.

KVM handles these paths inconsistently. On a trapped ZCR_EL2 write, KVM immediately caps ZCR_EL2.LEN to the VM's configured vector length limit. On a ZCR_EL1 write, KVM performs no capping and stores the raw value. During context restore, the guest hypervisor's stored view of ZCR_EL2 is programmed directly into the physical register.

The inconsistency creates two problems. First, immediate capping on the ZCR_EL2 accessor destroys stateful bits in the LEN field that software may legitimately rely on. Second, the untrapped ZCR_EL1 path bypasses capping entirely, exposing vector lengths the L2 guest is not authorized to use.

Root Cause

The root cause is missing input validation at the SVE context restore point. Capping was performed at the accessor level rather than at the hardware programming boundary, and only one of two accessor paths enforced the limit. The fix moves vector length capping to the restore path so hardware is always programmed with a sanitised value regardless of the accessor used, and marks ZCR_EL2 as a sanitised register with only the LEN field stateful.

Attack Vector

Exploitation requires local access with low privileges inside a virtualized guest running under a nested VHE hypervisor configuration. An attacker in an L2 guest writes an out-of-range vector length via the ZCR_EL1 accessor, avoiding the trap-based capping logic. On the next context switch, the physical ZCR_EL2 register receives the unsanitised value, granting the guest access to SVE vector lengths outside its assigned constraints. This breaches virtualization confidentiality, integrity, and availability guarantees across the security boundary (scope change).

Refer to the fix commits Kernel Git Commit 742a9b5 and Kernel Git Commit 8372633 for the exact code paths modified.

Detection Methods for CVE-2026-63941

Indicators of Compromise

Unexpected SVE vector length values reported by L2 guests in nested KVM configurations
Guest workloads executing SVE instructions with vector lengths exceeding the VM's configured limit
Kernel logs showing anomalous ZCR_EL2 state transitions on arm64 hosts running nested virtualization

Detection Strategies

Audit running kernels on arm64 hosts and compare against the fixed commit hashes 742a9b5 and 8372633
Inventory hosts that enable nested virtualization with VHE guest hypervisors and SVE exposure to guests
Correlate guest crash telemetry or SVE-related faults with hosts running unpatched kernel builds

Monitoring Recommendations

Track kernel package versions across arm64 hypervisor fleets and alert on divergence from the patched baseline
Monitor guest-to-host trap frequency for ZCR_EL2 accesses to identify anomalous virtualization behavior
Log and review nested KVM configuration changes and SVE feature exposure per VM

How to Mitigate CVE-2026-63941

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 742a9b5 and 8372633 to all affected arm64 hosts
Prioritize patching for arm64 systems that expose SVE to guests and run nested VHE hypervisors
Rebuild and redeploy custom kernel images that include the arm64 KVM subsystem

Patch Information

The fix moves vector length capping from the register accessor to the SVE context restore path, ensuring the physical ZCR_EL2 is always programmed with a bounded value. ZCR_EL2 is additionally marked as a sanitised register with a RES0 mask so only the LEN field remains stateful. Patched commits are available at Kernel Git Commit 742a9b5 and Kernel Git Commit 8372633.

Workarounds

Disable nested virtualization on arm64 hosts until the patched kernel is deployed
Do not expose SVE features to guest VMs where nested VHE hypervisors are in use
Restrict local guest access to trusted workloads on affected hypervisors pending remediation

bash

# Verify running kernel version on arm64 hosts
uname -r

# Check whether nested virtualization is enabled on KVM arm64
cat /sys/module/kvm/parameters/nested

# Temporary workaround: disable nested KVM until patched kernel is deployed
echo N | sudo tee /sys/module/kvm/parameters/nested