Linux Kernel EUVD-2026-32774

Exploitation requires: (1) arm64 hardware with pKVM (protected KVM) explicitly enabled in the kernel - pKVM is not the default KVM mode and must be enabled via kvm-arm.protected=1 or equivalent boot parameter; (2) local access to the system with at least low-privilege user credentials sufficient to access /dev/kvm (typically membership in the 'kvm' group); (3) the ability to invoke KVM ioctls to create and initialize vCPUs, specifically to trigger the __pkvm_init_vcpu() error path. The race condition in Bug 2 additionally requires concurrent vCPU initialization calls, increasing practical complexity. Exploitation is limited by: the requirement for arm64 architecture, pKVM mode being non-default, local-only attack vector (AV:L), and the need to repeatedly trigger error paths to exhaust resources meaningfully. Remote exploitation is not possible.

CVSS 3.1 scores this at 5.5 Medium with AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, correctly reflecting that exploitation is entirely local, requires only low privileges (a user with KVM device access), and results solely in availability impact - no confidentiality or integrity compromise. EPSS at 0.02% (4th percentile) confirms this is a low-probability exploitation target, consistent with a niche kernel subsystem (pKVM on arm64) that is not universally deployed. There is no CISA KEV listing and no public POC identified at time of analysis. The EUVD tag of 'Information Disclosure' conflicts with the CVSS C:N metric; this discrepancy is likely a tagging error since the CVE description and CVSS both indicate no confidentiality impact. The race condition in Bug 2 theoretically allows reading partially initialized kernel memory, which could be interpreted as a weak information disclosure primitive, but this is not confirmed by the authoritative CVSS vector. Real-world prioritization: this is a correctness and stability bug in a specialized pKVM configuration on arm64 hardware; it is not a broadly exploitable privilege escalation or remote code execution. Patch urgency is appropriate for next scheduled maintenance cycle on affected arm64 hypervisor deployments, not an emergency response.

A local attacker with access to /dev/kvm on an arm64 system running a pKVM-enabled kernel deliberately triggers initialization failures during vCPU creation - for example by passing invalid parameters or causing resource contention - causing the error path in __pkvm_init_vcpu() to execute repeatedly without releasing pin references. Over time, the leaked pin references exhaust the available pinnable pages for the hypervisor, degrading or crashing protected VM operations and causing a denial of service against hosted guests. No public POC is available; exploitation would require detailed knowledge of pKVM internals and the ability to reliably trigger the error path.