The defect causes KVM’s magic sanity check to apply only to direct MMUs, leaving writes from host userspace untracked. When a host user manipulates page tables outside KVM’s tracking, the shadow paging rules can be violated, exposing a logical inconsistency that may manifest as memory corruption or unexpected processor faults during guest execution.

The vulnerability affects the Linux kernel’s KVM implementation, notably the kvm, kvm_intel, and irqbypass modules running on kernel versions that include the recent 7.0.0-rc2 snapshot. No specific vendor version range is listed, so all kernel releases that incorporate the unpatched code are potentially impacted.

With a CVSS score of 5.5 and an EPSS probability of less than 1 %, the risk is moderate and the likelihood of exploitation is low. The issue is not present in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves host‑level userspace performing unauthorized writes to guest page tables, which could break KVM’s shadow paging state and lead to data corruption or kernel instability.