The kernel function sev_mem_enc_register_region lacks proper locking when accessing sev_guest() in the SEV implementation of KVM. Without holding kvm->lock, it can dereference a null pointer, leading to a general protection fault that crashes the kernel and results in a denial of service. This flaw is classified as CWE‑413 and CWE‑476, indicating improper handling of kernel objects and a potential null pointer dereference.

Affected systems are Linux kernel installations that include the KVM virtual‑machine monitor with SEV support. The CVE list does not provide a specific affected version, so any kernel that offers this feature and has not yet been updated to remove the race may be vulnerable.

The CVSS score of 5.5 marks it as a moderate severity vulnerability. The EPSS score is below 1%, indicating a very low probability of exploitation in the wild, and it does not appear in CISA's KEV catalog. Based on the description, it is inferred that exploitation likely requires root‑level access to the host or the ability to issue ioctl calls against /dev/kvm, making it a privileged local vulnerability. This makes it a local privilege escalation or a low‑impact exploit, requiring the attacker to be able to create or manipulate KVM virtual machines on a compromised host. The attack vector is therefore a local privileged user.