The flaw lies in the Linux kernel’s KVM SVM module when it runs on Hygon Family 18h processors, which emulate the hardware erratum known as #1235. During an ICR write the CPU may read a stale IsRunning bit and silently skip the expected VM-Exit that would wake a target virtual CPU. As a result, KVM fails to interrupt a blocked vCPU, causing that CPU to hang or become severely delayed, which manifests as a denial‑of‑service to the guest. The weakness corresponds to uncontrolled resource consumption and is identified as CWE‑367.

Any system that runs the Linux kernel with KVM SVM enabled on a Hygon Family 18h processor is susceptible, since the hardware inherits the same erratum as AMD Family 17h. No explicit kernel version bounds are given, so any kernel build containing the pre‑patch SVM code path on these CPUs may be vulnerable. Systems using generic AMD Family 17h processors could also be affected by the shared erratum.

The CVSS score of 7.1 classifies the risk as moderate to high, while the EPSS score of <1% indicates a very low chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local to the host running KVM on the affected processor family. Based on the description, it is inferred that exploitation would require privileges to trigger IPI writes within the KVM environment, either from the guest or from the host, which would cause stuck or heavily delayed virtual CPUs.