The vulnerability resides in the Linux KVM arm64 implementation. When an error occurs after hyp_pin_shared_mem() succeeds, the cleanup logic skips unpinning host vCPU and SVE state references, permanently leaking pin counts on the host. Additionally, the newly created vCPU pointer is published with a plain store, allowing concurrent readers to observe a partially initialized object. These defects can lead to resource exhaustion and unreliable kernel state, potentially resulting in service disruption for the host system.

All Linux distributions running a kernel that includes the KVM arm64 code path are affected, as the flaw pertains to the generic Linux kernel kernel module. Users must verify whether the patch that fixes the pin leak and ordering has been applied in their specific kernel release.

The CVSS score is not provided and EPSS is unavailable, but the issue is listed as not being in CISA KEV. Exploitation likely requires a malicious guest VM to trigger the error path, and the bug introduces a data‑race that could degrade system reliability. The overall risk is moderate to high for environments with unmanaged or untrusted virtual machines, and the impact could manifest as denial of service or resource depletion.