A race exists between the VMX synchronization of the pending interrupt register (PIR) and the delivery of posted interrupts. The sender sets two atomic bits, but they are not combined into a single transaction, allowing the target virtual CPU to clear and harvest a now‑empty PIR while the PID.ON bit is still set. This bug causes the kernel to compute an incorrect maximum IRR, emit an awkward warning, and incur an unnecessary L2 VM‑Enter/VM‑Exit transition. No data loss occurs, but the extra cycles can degrade performance under a heavily loaded nested VM program, and the warning generates noise in the log system. The weakness aligns with CWE-821.

Linux kernel hosts running KVM on x86 architectures with nested virtualization. The flaw affects any configuration that enables nested virtualization. Specific kernel releases affected are not listed; the bug was fixed in the commit 33fd0ccd referenced in the data. Applications using older kernels that run nested VMs may experience spurious WARN messages and a slight performance hit.

There is no publicly disclosed exploitation vector. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog. The CVSS score is 5.5. An attacker would need to run a nested VM under heavy IPI traffic to trigger the race, making it unlikely to be widely exploitable. The impact is limited to performance degradation and noisy logs rather than data loss or confidentiality compromise.