Linux Kernel EUVD-2026-103706

Requires the target to be running KVM in protected mode (pKVM) on arm64 - the vulnerable fix_host_ownership() ownership-transfer path only exists in that configuration. The attacker must already hold host-kernel-level privilege (CVSS PR:H, AV:L), i.e. local code execution within the untrusted host that pKVM isolates; it is not reachable by an unprivileged user or over a network. The concrete defect: each CPU's hyp stack is mapped in the private VA range (for its guard page) and has no linear-map alias, so the host-stage-2 ownership walker never removed those pages, leaving them accessible to the host. Limiting factors: arm64 only, pKVM must be enabled, requires high host privilege, and exploitation is local with no user interaction needed.

Signals are consistent and point to a real-but-bounded priority rather than an urgent widespread threat. The CVSS base score of 8.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is driven mostly by the scope change (S:C) and full C/I/A impact, reflecting that the flaw crosses the host→hypervisor trust boundary; however, AV:L and PR:H mean the attacker must already be executing with high privilege locally (effectively host-kernel level), which is a significant barrier. EPSS is low at 0.20% (9th percentile), the CVE is NOT on the CISA KEV list, and no exploit or PoC reference is present - only vendor patch commits. The vuln.today decision label is 'this_week', consistent with a serious isolation bug that warrants prompt patching but is not an emergency. The signals do not conflict: low EPSS plus no KEV plus a local/high-privilege vector together indicate this is a severe correctness/isolation defect in a narrow configuration (arm64 protected KVM / pKVM), not a mass-exploitation candidate. Its importance is specific to the pKVM threat model, where the host is deliberately untrusted and is supposed to be unable to reach hypervisor memory; this bug defeats exactly that guarantee.

On an arm64 system running KVM in protected mode (pKVM), an attacker who has already achieved host-kernel execution reads or corrupts the per-CPU hypervisor stack pages, which were left mapped in the host's stage-2 translation because fix_host_ownership() only walked the linear-map alias and missed the stacks' private VA range. This lets a compromised host violate the host/hypervisor isolation pKVM is designed to enforce, exposing or tampering with hypervisor state. No public exploit or PoC was identified at time of analysis; the only references are the upstream kernel fix commits.