PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63941 Linux CVE debrief

The Linux kernel was vulnerable to an issue where a VHE guest hypervisor could improperly update the ZCR_EL2 register, potentially allowing L2 guests to access vector lengths they should not have access to. This was due to KVM handling ZCR_EL2 and ZCR_EL1 updates differently, leading to potential statefulness issues with the ZCR_EL2.LEN field. The fix moves vector length capping to the restore points, ensuring the hardware is always programmed with a capped value and the ZCR_EL2.LEN field remains stateful.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Organizations using KVM on arm64 architectures, especially those with multi-level guest hypervisors, should assess the impact of this vulnerability on their systems and apply the necessary patches.

Technical summary

The vulnerability was found in the KVM implementation for arm64 in the Linux kernel. Specifically, it relates to how the ZCR_EL2 register is handled when updated by a VHE guest hypervisor. The ZCR_EL2 register controls the vector length for SVE (Scalable Vector Extensions) in the ARM architecture. The issue arose because updates to ZCR_EL2 could be done either directly or through ZCR_EL1, with KVM handling these updates differently. When updated directly, KVM would cap the vector length at the VM's own limit, but when updated through ZCR_EL1, no capping was performed. This discrepancy could lead to L2 guests accessing vector lengths they were not authorized for, potentially causing security issues. The fix involves moving the vector length capping to the restore points, ensuring that the hardware always sees a capped value and that the ZCR_EL2.LEN field behaves statefully.

Defensive priority

High

Recommended defensive actions

  • Apply the official kernel patches to update KVM's handling of ZCR_EL2 and ensure proper capping of vector lengths for guest hypervisors.
  • Review and update KVM configurations to enforce strict access controls for guest hypervisors.
  • Monitor system logs for unusual activity related to SVE or KVM operations.
  • Perform a thorough review of the system to identify potential exposure.
  • Implement compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions and retest remediated assets.
  • Verify that the patches have been successfully applied and are functioning as expected.

Evidence notes

The CVE record was published on 2026-07-19T16:17:12.643Z and has not been modified since then. The NVD entry is currently Received. Official references include links to the Linux kernel stable commits addressing the issue.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:12.643Z and has not been modified since then.