The Linux kernel's KVM SEV module incorrectly computes the maximum length of the in‑GHCB scratch area. The code treats the supplied length as a minimum, while the protection state controller path actually requires the full size to avoid buffer overflows. This miscalculation, classified as CWE‑131, can allow a malicious guest to overflow the scratch buffer, corrupt host memory, and achieve arbitrary code execution on the host.

All Linux installations running the KVM hypervisor with Secure Encrypted Virtualization enabled are potentially affected. The vulnerability applies to any kernel that has not incorporated the patches in the cited commits, regardless of distribution or release version, as the change is in the kernel's core KVM code.

The CVSS score of 9.3 indicates a high severity, and the EPSS score of less than 1% suggests low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread attacks. The likely attack vector is a compromised or malicious guest VM that issues a protection state controller request triggering an out‑of‑bounds write, thereby enabling the attacker to gain host control. The risk escalates if the host runs untrusted guests without additional isolation.