The vulnerability is a race condition in the Linux kernel’s handling of the guest‑accessible Page State Change (PSC) buffer used by the SEV hypervisor. The kernel reads entries and indices from the buffer without using the READ_ONCE() macro, which prevents time‑of‑check/time‑of‑use errors. Because this guarding was missing, a guest could potentially modify the buffer content between the moment it is read and the moment it is used, creating a data‑consistency issue that could affect the host kernel’s page‑state operations. The description indicates that the fix was added to defend against TOCTOU bugs, implying that the flaw could permit misuse of the PSC buffer but does not explicitly state the exact damage. Overall, the weakness threatens kernel integrity when a guest can influence the PSC buffer.

The flaw is present in the Linux kernel source. Any Linux system running a kernel build that supports KVM with SEV enabled and that has not applied the commit that adds READ_ONCE protection is affected. Distribution vendors are not listed; the vulnerability applies equally to all upstream kernel versions prior to the patch, and the impact is tied to KVM/SEV usage rather than a specific vendor product.

The base CVSS score is 8.8, indicating high severity for kernel integrity. The EPSS score is <1%, reflecting a low probability of active exploitation at present. The flaw is not listed in the CISA KEV catalog, signifying no publicly known exploits. A likely attack vector involves a malicious guest that can interact with the PSC buffer. Based on the description, the vulnerability could be leveraged by a guest to alter the PSC buffer between read and use, potentially leading to kernel state inconsistencies. No public exploitation evidence is available.