The Linux kernel flaw was that the KVM implementation for Secure Encrypted Virtualization (SEV) did not properly ignore port I/O requests whose length was zero. Such requests could cause an integer underflow when setting up the SEV software scratch area or other internal data structures, potentially leading to a kernel crash or unintended behavior. The applied fix adds an explicit check to skip processing any zero‑length requests, the underflow and stabilizing the I/O handling path.

Linux kernels that include the KVM subsystem with SEV support are affected. The vulnerability exists in any kernel build released before the commit that adds the zero‑length code location so any kernel version newer than those changes is considered fixed. Older or custom kernels that have not applied the patch remain vulnerable.

The vulnerability is rated CVSS 9.3, reflecting a high severity if exploited. However, the EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, indicating that observed exploitation is unlikely. Based on the description, it is inferred that attackers would need privileged access to the host or to a SEV‑enabled virtual machine to construct a zero‑length port I/O request, making remote exploitation impractical. Based on the description, it is inferred that the exploitation path involves manipulating low‑level port I/O operations from within the SEV context, a capability normally restricted to the host or to very high‑privileged guests.