The vulnerability resides in the Linux kernel’s KVM MMU when recovering hugepages. An unchecked bound check allows a guest operating system to create a hugepage mapping that extends beyond the bounds of a target memory slot, causing the host kernel to perform an out‑of‑bounds read of lpage_info data. This out‑of‑bounds access leads to a host page fault and kernel crash, resulting in denial of service. No additional exploitation, such as privilege escalation or data disclosure, is documented in the current description.

The affected systems are the Linux kernel, specifically the KVM hypervisor component. The issue impacts any host running an unpatched kernel where KVM is in use, regardless of specific distribution versions, because the patch is applied at the kernel level.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not in CISA's KEV catalog. The likely attack vector is a guest VM that explicitly configures a hugepage mapping whose address range lies partially below a memory slot boundary; this miss alignment can be triggered by normal allocation or via a crafted memory region request. The attack does not require host compromise and is local to the virtual environment, but it can reliably crash the host kernel. The absence of remote trigger mechanisms limits the attack surface, though a compromised guest is sufficient.