In the Linux kernel's KVM subsystem for x86, the kernel incorrectly ignores a –EBUSY return code during the vcpu_block routine when a virtual CPU leaves a blocking state. This oversight triggers an unsolicited userspace exit that normally terminates the virtual machine. Even if execution continues past the wakeup, an injected event or pending nested run can leave the VM in an inconsistent state, leading to instability or a crash.

The vulnerability affects the Linux kernel on all x86 architectures that have not incorporated the fix present in the later commits referenced in the CVE. The CVE data does not list explicit kernel version numbers, so the affected versions are unknown; any build prior to the merge of the patches is potentially vulnerable. Distribution kernels shipping the vulnerable upstream code are included.

Exploitation requires a privileged userspace component that can inject hardware or software events or alter the MP_STATE field while a vCPU is blocked. Based on the description, this is inferred to be the likely attack vector, as the kernel allows such changes from userspace. The CVSS score of 5.5 denotes moderate severity; the EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA KEV. Nonetheless, a successful attack would result in denial of service for the affected virtual machine, disrupting availability.