The KVM module in the Linux kernel contains an incorrect check for nested EPT/NPT when processing slow flush hypercalls. Because translate_nested_gpa() is only valid when an L2 guest operates with nested EPT/NPT enabled, the code incorrectly relies on is_guest_mode(vcpu). As a result, the hypervisor may execute translation paths that are intended only for nested paging, which can trigger invalid memory operations and cause a kernel panic. The flaw is a CWE‑266 weakness where a security‑related condition is omitted or misused. In practice, a compromised or maliciously crafted nested guest that can invoke the specific hypercall may trigger the crash, leading to a loss of the underlying virtual machine and potentially the entire host.

Any Linux distribution that ships with the standard Linux kernel and supports KVM may be affected. The exposed code exists in the core KVM module and is present in all kernel versions before the commit that added the proper nested‑EPT/NPT guard. Hence, all builds built from the mainline kernel prior to that change are vulnerable regardless of distribution or kernel release number.

The CVSS score of 5.5 indicates a moderate risk and the EPSS score of < 1 % reflects a very low exploitation probability. The vulnerability is not listed in CISA's KEV catalog. The bug only manifests in environments that use nested virtualization and exploit the specific slow flush hypercall sequence. The likely attack vector is a local or privileged nested guest that can trigger the hypercall; indirect remote exploitation is not presumed. Operators running nested guests should consider the potential of hypervisor instability, whereas hosts that disable nested virtualization or EPT/NPT are effectively insulated from this issue.