The vulnerability resides in the Linux KVM arm64 implementation. When an error occurs after hyp_pin_shared_mem() succeeds, the cleanup logic skips unpinning host VCPU and SVE state references, permanently leaking pin counts on the host. Additionally, the newly created vCPU pointer is published with a plain store, allowing concurrent readers to observe a partially initialized object. These defects can lead to resource exhaustion and unreliable kernel state, potentially resulting in service disruption for the host system.

All Linux distributions running a kernel that includes the KVM arm64 code path are affected, as the flaw pertains to the generic Linux kernel module. Users must verify whether the patch that fixes the pin leak and ordering has been applied in their specific kernel release.

The EPSS score is less than 1%, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 5.5 classifies it as medium severity. Exploitation likely requires a malicious guest VM to trigger the error path; the bug introduces a data‑race that could degrade system reliability. The overall risk is moderate to high for environments with unmanaged or untrusted virtual machines, and the impact could manifest as denial of service or resource depletion.