The flaw occurs in the Linux kernel’s KVM module when a small write (8 bytes or less) is performed on a memory‑mapped I/O (MMIO) region that is split across a page boundary. Instead of pointing to the caller’s stack variable, the kernel copies the value to a scratch field, but if a second fragment is later processed it may reference the original on‑stack data that has already been freed. This introduces a use‑after‑free condition that can corrupt kernel memory, potentially enabling an attacker with access to a virtual machine to overwrite privileged data or execute arbitrary code. The bug is classified as CWE‑825 and carries a CVSS score of 8.8, indicating a high‑severity vulnerability.

The issue affects all Linux kernel builds that include the KVM x86 backend, regardless of distributor or specific kernel version. No fixed version information is supplied, so any kernel containing the unpatched MMIO handling logic is potentially vulnerable. The vulnerability description does not specify a limited vendor or product line beyond Linux, meaning all Linux‑based hosts running KVM are at risk.

The EPSS score of less than 1 % suggests that, at the time of assessment, exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog, and remediation is only available through a kernel patch. An attacker would need to provoke a split MMIO write from a virtual machine, a scenario that can be triggered by normal VM operation or by a crafted guest program. Given the high CVSS score, the potential impact on confidentiality, integrity, and availability is significant if the exploit succeeds, so the risk warrants prompt mitigation.