Linux Kernel EUVD-2026-103709

Requires an arm64 host with KVM enabled that is running a 32-bit (AArch32) guest, and the attacker must be able to execute an access to the DBGBXVR<n> debug/breakpoint register from within that guest. Limiting factors: the flaw is unreachable on AArch64-only guests, on non-virtualization Linux deployments, and on non-arm64 architectures; exploitation is local to the guest (AV:L), produces only availability loss (the VM is marked dead), and exposes no data. It is a regression affecting kernels from the accessor-consolidation change up to the fixed stable releases (6.18.55, 7.2.9, 7.3-rc5).

This is a low-urgency availability bug, not a high-impact priority despite the 7.1 CVSS. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) correctly reflects a local, denial-of-service-only impact (C:N/I:N/A:H) reachable across a scope boundary (S:C, guest-to-hypervisor), with no confidentiality or integrity exposure. The 'attacker' here is code running inside an AArch32 (32-bit) guest on an arm64 KVM host; triggering the flaw requires access to that guest, so the practical blast radius is a guest DoSing the VM it runs in via KVM_BUG_ON() marking the VM dead. Exploitation signals are weak and mutually consistent: EPSS is 0.20% (9th percentile), there is no CISA KEV listing, and no PoC or exploit reference is supplied - exploitation status is 'no public exploit identified at time of analysis'. The vuln.today 'this_week' label reflects normal stable-kernel patch cadence rather than active-threat urgency. One conflict to flag explicitly: the input Tags include 'Information Disclosure', which contradicts the CVSS impact metrics (C:N, no confidentiality impact) - this is an availability/DoS issue, so treat the tag as mislabeled. CWE is N/A in the input.

On an arm64 host running KVM, an attacker who controls a 32-bit (AArch32) guest executes an access to the DBGBXVR<n> breakpoint register. Because the register (Op2 1) is routed through demux_wb_reg(), which only handles Op2 4-7, the access hits KVM_BUG_ON() and the VM is marked dead, denying service. No public exploit identified at time of analysis; the attack requires local execution within the affected guest (AV:L).