The Linux kernel’s KVM module for x86 processors has a defect in which the vendor‑specific exit handler runs after the fastpath userspace exit. Because the exit ordering is wrong, a required flush of the Processor‑Modification Log (PML) buffer can be skipped, causing any memory written during the final KVM_RUN to remain unmarked as dirty. A guest process that regains control may then observe stale or incomplete state. The flaw is a race condition (CWE‑362) and a concurrency issue (CWE‑367), and while it does not allow remote code execution, it can let a local attacker within the host exploit the stale‑state condition to modify VM state or cause a denial of service inside a virtual machine.

All Linux installations running the KVM virtualization stack on x86 that have a kernel version prior to the commit that makes the vendor exit handler run before the fastpath user‑space exit are affected. The kernel family is listed as the affected platform, but no explicit version range is provided, so any older kernel lacking the patch is in scope until the patch is applied.

The CVSS score of 7.1 indicates a medium severity vulnerability. The EPSS score is below 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation in the wild. Nevertheless, a malicious guest resident in the host can trigger the fastpath exit path and exploit the stale‑state condition. The flaw is local to the host‑guest boundary; an external attacker would need to gain a foothold in the host to use it. The overall risk is moderate due to the functional impact on VM state and the low likelihood of exploitation.