The flaw in the Linux kernel’s KVM implementation allows a userspace process that manages a virtual machine to manipulate or run a vCPU while its state is being synchronized and encrypted for SEV (Secure Encrypted Virtualization) guests. This unsynchronized access can corrupt the vCPU’s state or, in the worst case, crash the host kernel. The flaw is classified under CWE‑820, indicating improper handling of shared state during synchronization.

Linux kernel systems running KVM are affected. No specific affected kernel version is listed; any kernel that has not incorporated the recent lock‑insertion patch is potentially vulnerable.

The CVSS score of 5.5 reflects a likely crash scenario and moderate exploitation complexity. The EPSS score is under 1%, indicating a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the ability to control the execution of a KVM guest on the host, suggesting a privileged or compromised userspace process as the attack vector. Once accessed, a malicious user could trigger state corruption and cause a kernel panic, effectively denying service to the host and any other VMs running on it.