The Linux kernel bug allows a caller to request that a region of memory be pinned so that it can be accessed by the hypervisor. The implementation incorrectly treats a short pin count as success, causing only part of the region to be protected and later used, which corrupts kernel memory, resulting in a classic out‑of‑bounds memory overwrite. Additionally, in the event of a mid‑loop failure the code does not correctly account for pages already pinned before flushing, leaking page references that can consume resources. The error handling deficiency also amounts to improper error handling (CWE‑390, NVD‑CWE‑Other). Together, these defects can lead to memory corruption, potentially allowing an attacker who can trigger the pin operation to execute arbitrary code with kernel privileges or to crash the system.

All Linux kernels that include the mshv hypervisor support are affected. The CNA listing shows the product as Linux:Linux and the CPE indicates the entire Linux kernel family; no specific version range is provided, so the issue applies to any kernel build containing the old pinning logic until the patch is applied.

The vulnerability carries a risk of kernel memory corruption, which can enable privilege escalation to root or destabilise the host. The CVSS score is 5.5, and the EPSS score is < 1%, so the exact likelihood of exploitation is unclear, but the presence of an EPSS entry does not guarantee that the vulnerability is unexploited. The issue is not listed in CISA’s KEV catalog. The likely attack vector requires privileged access to the kernel or control over a guest that exercises hypervisor memory pinning; an attacker could trigger the fault by invoking a poorly handled pin request, leading to corruption or resource exhaustion.