The vulnerability is a CWE‑825 use‑after‑free flaw in the Linux KVM x86 shadow‑paging subsystem. An external change to a PDE mapping can cause the RMAP entry to retain a reference to a page that has been freed, leading to memory accesses to the stale page. This exposes the host kernel to potential crash or, if exploitable, privilege escalation.

All Linux kernels running on x86 that use KVM and contain the unpatched shadow paging logic are affected. The affected product is the generic Linux kernel as listed in the CPE—no specific distribution or version range is enumerated by the CNA, so any distribution on the impacted kernel version should be considered vulnerable.

The CVSS score is 8.8, indicating a high severity. The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, implying a low likelihood of widespread exploitation. Based on the description, it is inferred that an attacker must be able to modify host PDE mappings from outside the guest, which typically requires privileged access within the KVM environment or host administrator rights. If an attacker can trigger the vulnerable memory‑slot removal sequence, the resulting use‑after‑free could cause a kernel crash or be harnessed for privilege escalation.