The vulnerability is caused by the QEMU VMware mouse emulation driver incorrectly clearing the high 32 bits of the %rdi register that the Linux kernel uses to hold a kernel stack pointer across the vmware_hypercall4 (and vmware_hypercall3) functions. This register clobber results in the kernel dereferencing an invalid address, triggering a supervisor page fault and a kernel panic. The impact is a local denial‑of‑service, potentially disrupting services running on the affected host. The weakness involves improper handling of register state across a hypercall and can be categorized as a data corruption flaw.

All Linux kernel builds that include vmmouse VMware hypercall support are affected, notably the release candidates of kernel 6.19 (rc1 through rc8) as indicated by the provided CPE strings. The issue applies to any setup where QEMU or other VMware emulation drivers use vmmouse hypercalls without preserving %rdi and %rsi. Updates to the kernel that mark those registers as clobbered for the relevant hypercalls eliminate the problem.

With a CVSS base score of 5.5 the vulnerability is of moderate severity, and the EPSS score is below 1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack surface requires an adversary who can trigger VMware hypercalls from within a QEMU‑based virtual machine or similar environment; it is not a remote exploitation vector and requires local or privileged access to the host or hypervisor. The overall risk remains moderate but warrants timely patching.