The vulnerability arises in the KVM virtualization component of the Linux kernel, where an incorrect warning mechanism prevented the proper cleanup of writable guest page mappings when a virtual machine terminated without a subsequent KVM_RUN call. This oversight could cause guest memory pages to remain mapped to userspace, leaking kernel resources and potentially exhausting available memory over time. The flaw is categorized as CWE‑772, indicating an unreleased resource due to improper handling.

All Linux kernel builds that incorporate the KVM subsystem are affected, with the issue most pronounced in x86 systems that enable SEV‑ES guest support. Hosts that create SEV‑ES virtual machines and then exit them without a following KVM_RUN—the operation normally required to clean up mappings—are especially susceptible.

The EPSS score is reported as less than 1 % and the vulnerability does not appear in the CISA KEV catalog, suggesting a low likelihood of exploitation in the wild. Attacks would require privileged host access or control over the creation and termination of virtual machines, and they do not provide direct code‑execution or privilege‑escalation paths. The primary risk is a denial‑of‑service condition resulting from a gradual exhaustion of host memory or page‑mapping resources. It is inferred that an adversary would need the ability to manipulate VM lifecycle events to trigger the leak.