In the Linux kernel KVM subsystem, an unchecked 64‑bit addition in a bounds check allows an attacker who can write arbitrary entries to the dirty ring to force the check to pass via unsigned wrap‑around. The crafted entries can then cause the kernel to read or clear memory structures past the end of the mapping, corrupting data used by the MMU and potentially enabling privilege escalation or host instability.

All Linux kernels that expose the /dev/kvm interface and implement the dirty ring logic are affected, including mainstream distributions using KVM as a hypervisor. No specific version numbers are supplied, so any kernel build prior to the patch that introduces the bounds‑check fix is vulnerable.

The vulnerability lacks a publicly defined CVSS or EPSS, but because it requires only local access to /dev/kvm and can be triggered by manipulating the dirty ring, the risk is considered high. An attacker with sufficient privileges or in a container using KVM could leverage the out‑of‑bounds read/write to corrupt host memory or gain elevated privileges. The issue is not listed in the CISA KEV catalog, but its potential for escalation warrants immediate remediation.