The Linux kernel’s KVM module contains an incorrect check for nested EPT/NPT on slow flush hypercalls. The bug incorrectly uses is_guest_mode(vcpu) instead of the condition required by translate_nested_gpa(). This oversight can cause the hypervisor to execute paths that are intended only when nested paging is enabled, potentially leading to invalid memory translations, kernel crashes, or unexpected behavior within the hypervisor.

Any Linux distribution that ships the standard Linux kernel with KVM support may be affected. No particular kernel version is noted, so any build containing the aforementioned KVM code before the recent commit should be considered vulnerable until the upstream change is applied.

There is no CVSS score listed and the EPSS score is unavailable, while the vulnerability is not yet present in CISA’s KEV catalog. The flaw only manifests in environments that use nested virtualization and invoke the specific slow flush hypercall sequence. Operators running nested guests may therefore face a higher risk of hypervisor instability, whereas systems with nested virtualization disabled are effectively insulated from this issue.