CVE-2026-80873 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
kvm_inject_el2_exception() writes ESR_EL2 for synchronous exceptions but not for SError. enter_exception64() does not write ESR_ELx for any exception type, so the constructed syndrome is dropped. A guest L2 hypervisor taking a nested SError observes stale ESR_EL2.
This affects both kvm_inject_nested_serror() and the EASE path in kvm_inject_nested_sea().
Write ESR_EL2 for except_type_serror, matching except_type_sync.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel contains a critical vulnerability within the KVM arm64 nested virtualization subsystem that results in incorrect exception syndrome reporting to guest hypervisors. This flaw specifically impacts the handling of SError exceptions, which are asynchronous error conditions such as hardware errors or system-level faults. When an L2 guest hypervisor encounters a nested SError, it expects to receive accurate diagnostic information via the ESR_EL2 register, which holds the Exception Syndrome Register for EL2. However, due to a coding oversight in the exception injection logic, this register is not updated with the correct syndrome value during the processing of asynchronous errors.
The technical root cause lies in the implementation of kvm_inject_el2_exception and enter_exception64 functions within the KVM arm64 codebase. The function kvm_inject_el2_exception correctly writes to ESR_EL2 for synchronous exceptions, ensuring that guest hypervisors receive proper context when handling faults like page faults or illegal instructions. However, it fails to perform this write operation for SError types. Furthermore, enter_exception64 does not populate the Exception Syndrome Register (ESR) for any exception type during its execution path. Consequently, when kvm_inject_nested_serror is invoked to inject a nested SError into an L2 guest, or when the EASE path in kvm_inject_nested_sea handles similar conditions, the constructed syndrome information is effectively dropped rather than being written to the architectural register.
This defect leads to significant operational impacts for systems relying on nested virtualization with arm64 architecture. A guest L2 hypervisor taking a nested SError will observe stale or uninitialized data in ESR_EL2 instead of the actual error details. This misrepresentation prevents the guest operating system from accurately diagnosing hardware failures, potentially leading to incorrect error handling decisions, system instability, or security bypasses if attackers can exploit the lack of proper exception context for privilege escalation or denial-of-service attacks against virtualized environments. The vulnerability affects both direct nested SError injection and specific paths within SEA (Synchronous External Abort) processing that utilize similar mechanisms.
To mitigate this issue, developers must ensure that ESR_EL2 is explicitly written with the correct syndrome value when handling except_type_serror conditions, mirroring the existing logic for synchronous exceptions. This patch aligns the behavior of asynchronous error injection with established standards for exception handling in virtualized environments. Organizations running nested KVM configurations on arm64 platforms should apply this kernel update promptly to restore accurate diagnostic capabilities and maintain system integrity against potential exploitation through malformed or unexpected hardware errors.
This vulnerability is classified under CWE-20, which covers Improper Input Validation, as the code fails to properly validate and process input data related to exception types before injecting them into guest contexts. It also relates to CWE-754, an improper check for unusual or exceptional conditions, where the software does not correctly handle a specific condition (SError) that is distinct from other handled exceptions. From a threat intelligence perspective, this flaw aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as attackers could potentially leverage misconfigured exception handling to execute arbitrary code within guest environments by manipulating error states or exploiting the lack of proper syndrome validation for privilege escalation vectors in virtualized systems.