A logic flaw in the Linux kernel’s KVM module causes the virtual machine control block (vmcb02) to receive an incorrect value for the NextRIP register when a nested hypervisor (L1) runs an L2 guest with a soft interrupt and the NRIPS feature disabled. Instead of capturing the true NextRIP value after the first L2 VMRUN, the kernel uses the current RIP, which is no longer valid after subsequent executions. This can result in the guest executing arbitrary instructions from an incorrect address, potentially allowing a malicious L2 guest to influence the host or compromise data integrity.

Linux kernel, any host running KVM with nested virtualization (L1) and guests (L2) that use soft interrupts while NRIPS is disabled. All current releases prior to the patch that introduced the conditional use of CurrentRIP versus NextRIP are affected.

The CVSS score is not provided, but the flaw represents a substantial integrity risk in nested virtualization contexts. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers would need to be able to run or influence a nested guest with soft interrupts; however, from the description it is inferred that the attack path requires nested virtualization usage and the presence of NRIPS disabled. Because the vulnerability is tied to a specific CPU state transition, exploitation may be complex and not trivially automated, but with sufficient control over the guest it could be leveraged to escape the guest or corrupt host state.