The vulnerability in the Linux kernel KVM arm64 code relates to the flush_hyp_vcpu() function, which copies the host virtual Generic Interrupt Controller (vGIC) state into the hypervisor's private vCPU state on each run. The vGIC list register save and restore operations rely on used_lrs as a loop bound, which must not exceed the number of implemented list registers. However, flush_hyp_vcpu() copied the vgic_v3 state verbatim from the host without clamping used_lrs, allowing a host-provided value to be used at EL2 to index the vgic_lr[] array and access ICH_LR<n>_EL2 registers potentially out of bounds. The patch fixes this by clamping used_lrs to the constant number of implemented list registers after copying, mirroring the trusted path behavior in vgic_flush_lr_state().

This vulnerability could allow improper indexing into the virtual GIC list registers at EL2 privilege level, which may lead to undefined behavior or potential security issues related to hypervisor state corruption or privilege escalation. However, no known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel with KVM on arm64 architecture.

A fix has been implemented that clamps the used_lrs value to the number of implemented list registers after copying the vGIC state in flush_hyp_vcpu(). Users should apply the official Linux kernel updates that include this patch once available. Patch status is not yet confirmed from the vendor advisory; check the Linux kernel mailing lists or vendor advisories for the current remediation guidance.