In the KVM module, a race between kvm_translate_vncr() and an MMU notifier can cause the early return path to bypass releasing a reference to a faulted‑in page frame number (PFN). The lingering reference keeps the PFN alive, effectively leaking the physical address of guest memory to the host kernel. This defect is an unreleased resource error (CWE-772) and a race condition (CWE-362) and leads to information disclosure. The CVE description states that inserting a call to kvm_release_faultin_page() resolves the issue by ensuring the PFN reference is released.

All arm64 Linux kernel versions that implement KVM and do not yet contain the commits c93681ae or 9f76b039 are affected. This includes any Linux distribution running an arm64 kernel with KVM enabled until the kernel is updated to a release that incorporates the fix.

The CVSS score of 4.7 indicates moderate severity. The EPSS score is < 1 % and the vulnerability is not listed in CISA KEV, suggesting a low probability of exploitation. The likely attack vector is a race condition that an attacker would need to trigger from within the host environment, potentially requiring precise timing or fault injection. While the technical feasibility exists, the combination of a low EPSS and lack of a known public exploit points to a relatively low exploitation risk for a typical deployment.