A use‑after‑free flaw in the KVM shadow MMU for x86 occurs when a guest modifies its page tables between VM entries. The kernel incorrectly assumes the guest frame number (GFN) of a shadow page remains constant, leading to a stale reverse mapping (rmap). When this rmap is later traversed, it dereferences a freed kvm_mmu_page, corrupting kernel memory and potentially enabling arbitrary host‑level code execution. The issue aligns with CWE‑825, where uninitialized or incorrectly deallocated memory is accessed, threatening confidentiality, integrity, and availability of the host system.

The vulnerability is present in all Linux kernel releases for x86 that include the legacy KVM shadow paging logic, specifically before the fix commit 06c19c967b845b63172601fe459667d973b7e6b7. It affects standard KVM deployments on Linux hosts where guests can access and modify their own page tables, as the flaw depends on guest‑initiated page table changes.

The CVSS score of 8.8 indicates high severity, while an EPSS score of less than 1% still points to a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a privileged guest that can manipulate its own page tables—a scenario that is common in many virtualized environments. While the presence of the use‑after‑free condition elevates the risk to potential host code execution, the low EPSS reflects limited known exploitation efforts. Nevertheless, the integrity risk inherent in dangling pointers and stale shadow pages warrants timely remediation.