The vulnerability stems from the Linux kernel’s KVM subsystem on arm64, where page table walks in fault injection and AT emulation are performed without acquiring the necessary SRCU lock. This oversight creates an unchecked race condition that can corrupt memory, leading to kernel panics or other unstable states. The weakness is a concurrency issue (CWE‑662) and a shared memory protection flaw (CWE‑820), allowing an attacker to manipulate shared data structures concurrently.

All Linux kernel arm64 builds that implement the KVM virtualization path prior to the fix in commit 97706097f9b851cfe55c3b00b083dfc2bcf542bc. The issue specifically affects the kvm_walk_nested_s2() and walk_s1() functions when used by __kvm_at_s12() and __kvm_find_s1_desc_level() without holding the kvm->srcu lock.

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests a low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation. The likely attack vector involves a malicious guest or privileged user triggering fault injection or AT emulation in KVM, potentially leading to memory corruption or a denial‑of‑service condition. This concurrency issue, identified as CWE‑662, and the shared‑memory protection flaw, identified as CWE‑820, mean that exploit success depends on precise timing and the ability to force the kernel to perform the problematic page‑table walks.