CVE-2026-64555: Linux Kernel Privilege Escalation Flaw

CVE-2026-64555 Overview

CVE-2026-64555 is a Linux kernel vulnerability in the Kernel-based Virtual Machine (KVM) subsystem for arm64. The flaw resides in kvm_hyp_handle_mops(), which handles Memory Operations (MOPS) exceptions during guest execution. When rewinding state for a MOPS exception, the function resets the single-step state machine by modifying vcpu_cpsr() and writing the result directly into hardware. Under nested virtualization, vcpu_cpsr() returns a synthetic value that KVM uses to model virtual EL2 (vEL2). This synthetic value requires translation before being written to hardware, and that translation is missing in the MOPS handler.

Critical Impact
A malicious or compromised guest running under nested virtualization on arm64 can trigger incorrect processor state restoration, leading to host kernel integrity and availability impact on the hypervisor.

Affected Products

Linux kernel with KVM arm64 support and nested virtualization (NV) enabled
arm64 hosts running guest virtual machines that use MOPS instructions
Distributions shipping the affected kernel commits prior to the fix

Discovery Timeline

2026-07-27 - CVE-2026-64555 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64555

Vulnerability Analysis

The defect is a Kernel Vulnerability in the arm64 KVM nested virtualization path. The Arm architecture introduces Memory Operations (MOPS) instructions (CPY*, SET*) that can be interrupted and resumed. When a MOPS exception is taken, KVM must rewind guest state, including clearing the single-step state machine in the Saved Program Status Register (SPSR).

kvm_hyp_handle_mops() calls vcpu_cpsr() to obtain the current program status, modifies bits, and writes the result back to hardware. In non-nested execution this is correct. Under nested virtualization, however, vcpu_cpsr() returns a synthetic representation that lets the rest of KVM treat vEL2 uniformly. Writing that synthetic value directly into the hardware SPSR skips the translation KVM applies on real exit paths, corrupting the processor state the guest observes on resumption.

Root Cause

The root cause is a missing state translation step. The synthetic vcpu_cpsr() value used by KVM to emulate vEL2 does not map one-to-one to the hardware SPSR_EL2 encoding. The upstream fix bypasses the synthetic accessor entirely and modifies SPSR_EL2 directly, allowing normal resynchronization to occur on the next full exit back to KVM. The relevant commits are 10a568010e82, 884b44256041, dd3b237eb778, and ff1022c3de46.

Attack Vector

Exploitation requires local access with the ability to run a guest virtual machine on an arm64 host with nested virtualization enabled. A guest can issue MOPS instructions crafted to trigger the exception path in kvm_hyp_handle_mops(), causing malformed SPSR state to be written to hardware. The resulting inconsistency can be used to escalate impact against the host hypervisor. No user interaction is required, and no exploit is currently public.

See the upstream references for technical details: Linux Kernel Commit 10a568010e82, Commit 884b44256041, Commit dd3b237eb778, and Commit ff1022c3de46.

Detection Methods for CVE-2026-64555

Indicators of Compromise

Unexpected KVM warnings or oops messages referencing kvm_hyp_handle_mops or SPSR handling in dmesg on arm64 hypervisor hosts
Guest virtual machines crashing or entering inconsistent execution states shortly after MOPS-related exceptions
Nested guests exhibiting single-step or PSTATE anomalies not tied to legitimate debugger activity

Detection Strategies

Inventory arm64 hypervisor hosts and identify kernels lacking the four fix commits listed above
Enable KVM tracing (trace-cmd on kvm:* events) to surface abnormal MOPS exception frequency from guests
Correlate host kernel logs with guest VM crash telemetry to identify repeat triggering of the code path

Monitoring Recommendations

Alert on repeated guest VM crashes originating from the same tenant on shared arm64 hypervisors
Monitor kernel ring buffer for KVM assertions, WARN_ON, or BUG output on arm64 hosts running nested workloads
Track kernel package versions across the fleet and flag hosts running vulnerable kernels with NV enabled

How to Mitigate CVE-2026-64555

Immediate Actions Required

Apply the upstream Linux kernel patches or vendor-provided kernel updates that include the four referenced commits
Restrict who can create and run nested virtual machines on affected arm64 hosts until patches are deployed
Audit multi-tenant arm64 hypervisor environments and prioritize patching hosts that expose nested virtualization to untrusted workloads

Patch Information

The fix modifies kvm_hyp_handle_mops() to write directly to SPSR_EL2 rather than round-tripping through the synthetic vcpu_cpsr() accessor. Merge the following stable commits or upgrade to a distribution kernel that includes them: 10a568010e82, 884b44256041, dd3b237eb778, and ff1022c3de46. Rebuild and reboot affected hosts after applying.

Workarounds

Disable nested virtualization on arm64 KVM hosts by loading kvm-arm without the nested parameter until the kernel is patched
Prevent guests from being configured with vEL2 exposure where nested workloads are not required
Limit guest workloads to trusted operators on affected hosts to reduce the local attack surface

bash

# Verify KVM arm64 nested virtualization status and kernel version
uname -r
cat /sys/module/kvm/parameters/nested 2>/dev/null

# Temporarily disable nested virtualization until patched
echo 'options kvm-arm nested=0' | sudo tee /etc/modprobe.d/kvm-arm.conf
sudo update-initramfs -u
# Reboot required for the change to take effect