The Linux kernel’s KVM module for x86 processors has a defect where the vendor‑specific exit handler runs after the fastpath userspace exit. This ordering prevents a required flush of the PML buffer, so memory changes made during the final KVM_RUN may never be marked dirty; the guest can then see stale or incomplete state when it regains control. This flaw exemplifies a flawed synchronization issue (CWE‑367) and does not provide remote code execution but can allow an attacker to manipulate VM state and potentially cause data loss or encapsulated denial of service inside a virtual machine.

All Linux installations using the KVM virtualization stack on x86 that run a kernel version lacking the vendor exit-handler fix are affected. The CID specifies an entire Linux kernel family but provides no explicit version range, so any kernel prior to the commit that adds the missing flush remains in scope until the patch is applied.

The CVSS score of 7.1 indicates a medium severity vulnerability. The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation in the wild. Nevertheless, an entity with virtualization privileges - such as a malicious guest resident in the host - can trigger the fastpath exit path and exploit the stale-state condition. The flaw is local to the host-guest boundary; an external attacker would need a foothold in the host to use it. Overall risk is moderate due to the functional impact on VM state and the low likelihood of exploitation.