The flaw resides in the KVM SVM debugging routine sev_dbg_crypt when encrypting data. The per-iteration transfer length is constrained by the source page offset but not by the destination page offset. When the destination offset exceeds the source offset, the function writes up to 4112 bytes into a 4096‑byte buffer, causing an overflow. This buffer overflow (CWE‑805) allows an attacker to corrupt kernel memory, potentially yielding a privilege escalation or local denial of service.

The vulnerability exists in the Linux kernel for all vendors that ship the default build of KVM with SEV debug enabled. The affected build is indicated by the internal cpe string cpe:2.3:o:linux:linux_kernel:* and the Linux kernel version referenced in the report (for example 7.0.0-smp--5ce9b0c48211-dbg #156). Any system running a kernel prior to the patch that contains the updated sev_dbg_crypt implementation is vulnerable.

The CVSS score of 7.0 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote with write access to the KVM interface; an attacker would need to trigger the sev_mem_enc_ioctl ioctl with carefully crafted parameters to cause the overflow. Once executed, the overwrite can alter kernel data structures leading to privilege escalation or a crash.