The flaw in the Linux kernel’s KVM SVM implementation means that the MSR_IA32_DEBUGCTLMSR and LBR MSRs were not enumerated for saving and restoring. As a result, when a virtual machine enables LBR virtualization, the host does not preserve the guest’s branch history correctly, and the state cannot be restored after a migration or a context switch. This broken save/restore path may allow information about the host or other guests’ branch direction, location, and timing to be unintentionally exposed or to corrupt the LBR state of another VM, potentially leading to data leakage or a denial‑of‑service condition. The recent patch re‑adds these MSRs to the save list and updates access controls so that writes to LBR MSRs are permitted only when the feature is enabled, thereby restoring correct isolation.

All Linux kernel versions running KVM with AMD SVM support that have not yet applied the commit that adds the missing LBR MSRs to the save list. This includes any system using the KVM module where LBR virtualization is enabled for a guest. The vendor designation is Linux kernel; specific sub‑versions are not enumerated in the advisory, so any kernel build predating the referenced patches is potentially affected.

The CVSS score is not supplied, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is from within a guest virtual machine that can invoke KVM_GET_MSR_INDEX_LIST or KVM_SET_MSRS; the attacker would need to enable LBR virtualization to exercise the path. Because the flaw relates to state handling rather than a direct code execution vector, the exploitation complexity is moderate, and the potential impact is limited to data leakage or instability across virtual machines. No public exploit is known at this time.