The vulnerability in the Linux kernel KVM arm64 implementation involved incorrect capping of the ZCR_EL2 register's LEN field when updated by a guest hypervisor. Updates via ZCR_EL2 traps were capped immediately, potentially breaking software relying on the full LEN field statefulness, while updates via ZCR_EL1 were not trapped or capped. Upon restoring the SVE context for an L2 guest, the raw ZCR_EL2 value could be written directly to hardware, allowing the L2 guest to access vector lengths beyond its allowed limit. The fix moves the capping logic to restore points to ensure consistent capping regardless of the accessor and sanitizes ZCR_EL2 so only the LEN field is stateful.

An L2 guest hypervisor could exploit this vulnerability to access vector lengths (VLs) that exceed its permitted limits, potentially leading to unauthorized access or manipulation of hardware vector registers. This could affect the isolation guarantees between nested guests in a virtualized environment on arm64 architectures using KVM.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a fix has been implemented in the Linux kernel source code. Users should monitor official Linux kernel releases and apply updates that include this fix once available.