CVE-2026-80873

What it actually does

KVM on arm64 fails to write ESR_EL2 when injecting nested SError exceptions via kvm_inject_nested_serror or the EASE path, so enter_exception64 leaves stale syndrome values visible to an L2 guest hypervisor.

Why it matters to the business

Nested virtualization workloads on ARM64 hosts may encounter incorrect error reporting or handling inside L2 hypervisors, leading to unexpected guest behavior or diagnostic blind spots in cloud or appliance environments.

How an attack unfolds

An attacker with control of a nested guest triggers an SError injection path; because the syndrome register is not updated, the L2 hypervisor processes stale exception information that can be used to influence error handling or leak prior exception state.

How to fix it

Apply the upstream KVM arm64 fix that writes ESR_EL2 for except_type_serror; rebuild and deploy updated kernel packages on all ARM64 hosts running KVM nested virtualization.

How to confirm the fix worked

Inspect the kvm_inject_el2_exception and enter_exception64 paths in the running kernel source or binary to confirm ESR_EL2 is written for SError exceptions; test nested SError injection and verify fresh syndrome values reach L2.

Typical attack path

1. Obtain execution inside an L1 guest with nested virtualization enabled
2. Force an SError that routes through kvm_inject_nested_serror or kvm_inject_nested_sea
3. Observe or act on the stale ESR_EL2 value presented to the L2 hypervisor

How to detect it

Review hypervisor and guest kernel logs for SError injection events or nested exception paths; correlate with any L2-visible stale syndrome values or unexpected error handling.

What your security team should do

• Prioritize kernel updates on any ARM64 systems exposing nested virtualization
• Audit nested-virt configurations and disable where not required
• Add monitoring for unexpected SError handling anomalies in L2 guests