This vulnerability arises in the Linux kernel’s KVM subsystem when binding a memslot to a guest_memfd file. The code incorrectly treats the memslot offset and size as signed 64‑bit values, allowing a signed overflow when the offset is very large and the size is added. The resulting negative sum is compared against the positive file length, always evaluating as smaller, so an absurdly high offset is accepted. This permits a KVM host to map guest memory at an offset beyond the underlying file size, potentially corrupting host memory or causing a crash. The flaw does not allow remote code execution directly from an external network host but can lead to denial of service or local privilege escalation if an attacker can control KVM guest memory configurations.

Any 64‑bit Linux kernel running the KVM hypervisor and using the guest_memfd mechanism. The issue exists within the core kernel source, affecting all vendors that ship the unpatched kernel for KVM‑enabled hosts.

The CVSS score of 7.0 indicates a high severity, while the EPSS score of less than 1 % suggests a very low likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable only by code with the ability to configure guestmem mapping (typically privileged). Therefore, the overall risk is moderate, primarily requiring an update to the kernel to eliminate the signed overflow.