The flaw is found in the Linux kernel’s KVM nested SVM implementation. A function that copies Last Branch Record (LBR) data to a nested virtual machine’s VMCB structure incorrectly clears state that is not architecturally defined. This mishandling can cause LBR information to leak across virtual machine boundaries, potentially exposing execution traces of one guest to another. The weakness reflects improper isolation of architectural state and results in an information exposure scenario.

Linux kernel builds that enable KVM with nested SVM (SVM) support are affected if the patch removing the invalid VMCB_LBR clearing logic has not been applied. No specific version range is provided, so all current builds that contain the referenced code are presumed vulnerable until the fix is applied.

The CVSS score of 5.5 indicates moderate severity. No public exploits are documented and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, suggesting low probability of exploitation on the internet. However, an attacker with local host or hypervisor privileges—such as a resident VM—could trigger the faulty copy during a nested SVM exit and gain access to the LBR data of other guests. Therefore the risk level is considered significant for environments that enforce strict isolation between virtual machines.