The vulnerability occurs when the Linux kernel’s KVM module installs a memory‑mapped I/O (MMIO) shadow page table entry (SPTE) without first removing an existing shadow‑present SPTE. This oversight can lead to stale or invalid guest page mappings, which may expose host memory corruption paths or mis‑directed guest accesses. The defect falls under CWE‑416, indicating a use‑after‑free style fault that can be exploited to disrupt isolation between guest and host, potentially enabling arbitrary code execution or denial of service on the host.

Linux kernel versions affected include all releases up to the kernel snapshot that contains the unpatched code, as indicated by the generic CPE cpe:2.3:o:linux:linux_kernel:*:*. The affected products are all KVM‑enabled Linux hosts running any CPU architecture that supports the x86 MMU and EPT, specifically those compiled with the default KVM drivers kvm_intel or kvm_amd. No specific major or minor version limits are listed, so all kernels that have not incorporated the fix remain vulnerable.

The CVSS score of 8.1 indicates high severity, while an EPSS score of less than 1% suggests low current exploitation likelihood, possibly due to required kernel privileges or the need for a carefully crafted VM to trigger the fault. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploited instances. The likely attack path involves a guest VM under a KVM hypervisor that performs a page fault on a stale mapping, causing the host to create an MMIO SPTE without clearing previous entries. If leveraged, an attacker could corrupt host memory or execute code in the host context. Mitigation requires a kernel update that introduces the patch correcting the SPTE handling logic.