The vulnerability arises in the Linux kernel’s KVM hypervisor when handling Secure Nested Paging (SNP) guests. During the construction of a guest_memfd object, KVM incorrectly pins a source page for read access, yet subsequently writes to that page via a kernel mapping. If the guest’s CPUID data is backed by a read‑only mapping, the kernel write can overwrite protected memory. This can lead to corruption of kernel data structures and, in the most severe scenario, arbitrary code execution or escalation of privileges. The weakness is a write to a region that should be read‑only, matching CWE‑787 (Out‑of‑Bounds Write).

All Linux kernel installations that include the KVM hypervisor with SEV support, specifically when running SNP guests. The issue is tied to how the kernel manages CPUID data for such guests; therefore any distribution or custom kernel build that retains the unpatched code path is potentially affected. No specific version range is listed, so the fix should be applied to any kernel version that contains the aforementioned commit.

The EPSS score is reported as less than 1%, indicating a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, which suggests that known exploits are not publicly available. The CVSS score is 5.5, indicating a medium severity. The likely attack vector is local to the virtual machine monitor (VMM); a malicious or compromised VMM that provides read‑only CPUID data could trigger the fault. Well‑behaved VMMs normally generate CPUID data dynamically and do not use read‑only mappings, so the practical risk to typical deployments is limited, but the potential impact of memory corruption cannot be dismissed. Organizations running KVM with SEV‑SNP guests should treat this as a memory‑corruption risk that could undermine kernel integrity.