In nested KVM environments, a bug caused the VMLOAD and VMSAVE emulation path to use the second virtual machine control block (vmcb02) instead of the first one (vmcb01) when those instructions were executed by a Level‑2 virtual machine and not intercepted by Level‑1. This incorrect use of vmcb02 can result in the guest’s state being saved to or restored from the wrong control block, causing memory corruption or unintended data exposure between virtual machines. The flaw does not directly enable arbitrary code execution but undermines the isolation guarantees of nested virtualization.

Linux kernel running KVM with nested virtualization enabled. No specific version range is listed, so any kernel that implements the vmcb02 field for VMSAVE/VMLOAD may be affected until the patch is applied.

The CVSS score is not listed, and the EPSS score is not available, so formal severity metrics are missing. The vulnerability is only exploitable in environments that use nested virtualization and where the L1 hypervisor does not intercept VMSAVE/VMLOAD. Because the flaw requires a nested virtual machine context to be triggered, the risk to a typical host system is limited, but it can be significant in multi‑tenant data‑center or cloud scenarios that rely on guest isolation. The defect was fixed in commit cc3ed80, which now forces the use of vmcb01 for both the emulation and actual instruction handling. Once patched, the risk is mitigated.