This vulnerability originates from a nil‑pointer dereference in the kubevirt virt‑controller when it processes a VM definition with an empty transient volume. An authenticated user with permission to create virtual machine instances can submit such a definition, causing the controller to crash and enter a restart loop. The crash disables the controller, interrupting VM lifecycle operations for the entire OpenShift Virtualization 4 cluster and resulting in a denial of service.

The flaw affects Red Hat OpenShift Virtualization 4. No specific product or version numbers are listed; the issue applies to any instance of the virtualization component that incorporates the vulnerable virt‑controller, regardless of version. Administrators should apply the vendor‑issued patch for this product once it becomes available.

The CVSS score of 6.5 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available but the need for authenticated privileged access limits the threat to insiders or compromised accounts. Once exploited, the DoS can bring down the entire virtualization services. The risk is moderate to high in environments where virtual machines are critical to business continuity.