Based on the description, it is inferred that the attack originates from a crafted SEV-SNP virtual machine that issues specially crafted VMGEXIT requests. The vulnerability arises in the KVM module of the Linux kernel when SEV‑SNP is enabled. The kernel allocates a scratch buffer inside the guest’s space, but the size is controlled by the guest. The kernel fails to enforce that this buffer resides in the GHCB scratch area required by the GHCB v2+ specification and does not validate the guest‑provided end_entry against the actual buffer length. As a result, the kernel can read from or write to memory locations outside the allocated buffer, enabling out‑of‑bounds reads and writes on the host heap. This is an instance of an out‑of‑bounds buffer overflow (CWE‑787) that allows an attacker to corrupt host kernel memory and reveal heap layout details.

The flaw is present in every Linux kernel that includes the unpatched KVM code for SEV‑SNP. Any host running KVM on a Linux kernel (regardless of version) with SEV‑SNP support enabled is potentially vulnerable until the GHCB scratch area enforcement patch is applied. The vulnerability does not affect kernels in which the enforcement has already been implemented.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score of < 1% indicates a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers need the ability to create or run an SEV‑SNP guest, which is typically controlled by a user of the host’s virtualization environment. Because a host can run multiple SEV‑SNP guests, an attacker can repeatedly trigger VMGEXIT operations, performing out‑of‑bounds reads or writes to adjacent kmalloc‑cg‑32 slab objects, leading to information disclosure or kernel memory corruption.