KVM ARM64 Kernel Context State Management Flaw

CVE-2026-64286 is a high-severity vulnerability (CVSS 8.2) in the Linux kernel's KVM hypervisor implementation for ARM64 architecture. The flaw exists in the flush_hyp_vcpu() function, which fails to properly clear the __hyp_running_vcpu field when copying host vCPU context into the hypervisor's private vCPU. This creates a state management issue where the hypervisor expects guest contexts to have a NULL __hyp_running_vcpu value, but the function copies context verbatim without enforcing this invariant. The vulnerability affects systems running Linux kernels with KVM ARM64 support, particularly those using protected KVM (pKVM) for virtualization. While not yet in CISA's known exploited vulnerabilities list, the impact is significant for cloud providers, ARM-based server environments, and systems relying on KVM-based isolation.

Though currently unmapped to specific MITRE ATT&CK techniques, this vulnerability represents a privilege escalation and hypervisor escape risk pattern. Detection with Casky's extended reasoning would focus on identifying anomalous vCPU context state transitions, kernel memory corruption patterns during hypervisor-guest boundary crossings, and unusual resource access from guest VMs attempting to influence hypervisor execution paths. Practitioners using Casky would see findings related to kernel debugging artifacts showing improper context initialization, unexpected __hyp_running_vcpu persistence across vCPU flushes, and potential lateral movement attempts from guest to host contexts. The skill mapping would emphasize defensive monitoring for hypervisor state inconsistencies and ARM64-specific kernel integrity checks that distinguish legitimate vCPU operations from exploitation attempts.