When an extended guest request is made, the kernel allocates a buffer to receive a certificate from the host, storing its size in a request structure. The host can reply with an error that also includes an invalid buffer size. The kernel then uses this host‑supplied length to calculate a page order and frees the buffer. Because the length may not correspond to the original allocation size, the calculation can be incorrect, corrupting the page allocator. This memory corruption could allow a malicious guest to trigger a kernel crash, escape to kernel privileges, or disrupt the system’s stability.

Linux kernel on systems using the fan‑in of the Linux CNA. Exact patch releases are not listed, but the fix is present in later kernel versions that include the commits referenced in the advisory. Users of any Linux distribution that ships with older kernel images are potentially affected.

The vulnerability involves a kernel‑mode memory corruption; therefore it is classified as a high‑impact flaw. No publicly available CVSS score is provided, and the EPSS value is not available, suggesting that exploitation likelihood is unknown but the potential impact is severe. The flaw is not catalogued in the CISA KEV list. Exploitation likely requires local or guest‑persistent access to the virtual machine, making the risk moderate to high pending the presence of vulnerable kernel versions.