The vulnerability arises from a missing bounds check on Page State Change requests in the Linux kernel’s KVM SEV implementation. If a guest machine provides a pointer that does not align with the start of the GHCB shared buffer, the kernel may validate an index against a smaller scratch area than intended, allowing an out‑of‑bounds memory access. Such an access could expose host kernel memory or corrupt kernel data, potentially facilitating privilege escalation or arbitrary code execution on the host.

Based on the lack of explicit versioning in the advisory, it is inferred that Linux kernel implementations shipping with the KVM SEV module are affected. The flaw likely exists across all current kernel releases that include the unpatched KVM SEV code path.

The CVSS score of 9.3 indicates critical severity, while the EPSS score of less than 1% reflects a very low estimated likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV. The likely attack vector is local to the virtualization layer, requiring the ability to run a vulnerable guest on an affected host; a guest with control over a VM could trigger the out‑of‑bounds read or write and potentially hijack host privileges.