The Linux kernel KVM hypervisor for x86 hyper‑V includes a bounds omission when checking whether a virtual processor ID resides in a sparse bank set. During a TLB flush for an L2 VCPU, the code copies the VP ID from the enlightened VMCS without enforcing the valid range of 0‑4095. If an out‑of‑bounds VP ID is supplied, the kernel performs a memory read outside the sparse bank buffer, potentially causing a use‑after‑free or other kernel instability. This flaw is a classic out‑of‑bounds read (CWE‑125).

The vulnerability applies to Linux kernel builds that include the KVM hyper‑V module and support sparse banker vCPU sets. No specific kernel release is enumerated in the CVE, so any kernel version lacking the upstream patch that bounds the bank index may be vulnerable.

The CVSS score of 8.4 signals high severity. The EPSS score is less than 1 %, and the issue is not in the CISA KEV catalog, indicating a low likelihood of exploitation at present. The breach would most likely be achievable by delivering a crafted hyper‑V hypercall from a virtual machine or a malicious host process. This inference is drawn from the fact that the flaw is triggered during a hyper‑V hypercall that performs a TLB flush, which requires privileged execution. The impact would be kernel instability or a crash; remote code execution is not explicitly indicated in the description. Overall, the risk is moderate to high, but the probability of exploitation remains low under normal conditions.