A bug in the Linux kernel’s KVM nested‑SVM (nSVM) path causes an invalid‑opcode exception, or #UD, whenever a Level 2 guest issues a VMMCALL that the host’s hypervisor is not configured to intercept, and the call is not one of the supported Hyper‑V hypercalls. Instead of forwarding the request to the host, KVM raises the #UD, which aborts the guest execution. The resulting crash or stalling of the Level 2 virtual machine is a denial of service that can be triggered by any malicious or misbehaving guest when nested virtualization is enabled.

The issue affects Linux hosts that run the kernel with KVM and have the nested‑SVM capability enabled. Any kernel that has not yet incorporated the commit that introduces the patch is vulnerable; administrators should consult the linked kernel commit logs to verify whether their running kernel contains the fix. No specific version range is listed in the advisory, so any configuration with nested SVM enabled prior to the patch is impacted.

The CVSS score is not disclosed and EPSS data is unavailable. The known KEV status indicates the vulnerability is not listed in the CISA KEV catalog. It is inferred that the most probable attack vector is a host hypervisor granting a malicious Level 2 guest the ability to issue arbitrary VMMCALLs; this requires access to a nested virtualization environment. Because the bug leads only to a guest crash rather than privilege escalation or data exfiltration, the risk level is moderate for environments that rely heavily on nested VMs, while the likelihood of exploitation is limited to scenarios where an attacker can control or influence the guest.