The flaw enables a malicious SEV‑SNP guest to trigger out‑of‑bounds read and write on the host kernel heap. By allocating a guest‑controlled buffer via kvzalloc and manipulating PSC parameters, the guest can read or overwrite adjacent slab objects, exposing heap layout or corrupting kernel memory. This allows an attacker to potentially elevate privileges or crash the host.

The vulnerability resides in the Linux kernel's KVM module when SEV‑SNP support is active. All kernel versions that ship the unpatched KVM code are affected. The advisory does not list specific kernel releases, so any Linux system running a virtualized environment with SEV‑SNP enabled may be vulnerable.

The CVSS score of 7.0 classifies the bug as high severity, while the EPSS score of less than 1% indicates a low exploitation probability at the time of analysis. The vulnerability is not currently cataloged in CISA's KEV list. Exploitation requires the ability to run a crafted SEV‑SNP guest, which is typically within a user’s control of a virtual machine. As the guest can repeatedly trigger VMGEXITs, a determined attacker can achieve heap corruption or information leakage with minimal effort once the environment is set up.