The Linux kernel’s KVM subsystem relies on the guest’s priority preemption register (PPR) to trigger virtual interrupt deliveries. When the PPR changes, but no new interrupts are pending, the kernel should recompute the CR8 intercept so that the TPR threshold remains accurate. Because this recomputation was omitted, a stale, high TPR_THRESHOLD value accumulates. During a subsequent VM entry, the processor enforces the TPR‑shadow check and detects a mismatch, which causes the entry to fail with hardware error 0x7. The failure manifests as a crash of the virtual machine or, in some nested‑virtualization environments, the host. This flaw therefore constitutes a denial‑of‑service vulnerability affecting the VM’s availability. While the code paths and state change that trigger the bug are internal to KVM, they can be reached by a privileged or local attacker who can influence guest PPR updates. The description does not indicate any means for arbitrary code execution, and the required trigger sequence is non‑obvious, making accidental exploitation unlikely. The impact is limited to a VM entry failure; no data exposure or privilege escalation is provided by this issue. However, the fault may lead to service interruption for applications running inside affected guests and potentially churn traffic in environments relying on continuous VM uptime. Affected systems—All Linux kernel hosts employing KVM on x86 processors, particularly those with older CPUs or nested‑virtualization platforms (e.g., Hyper‑V) that enforce TPR shadow checks, could be impacted. The condition is specific to the kernel’s handling path when virtual‑interrupt delivery is disabled or unsupported. The CVSS base score of 5.5 classifies the vulnerability as moderate severity. The EPSS score of < 1 % and its absence from the CISA KEV catalog suggest a low likelihood of exploitation in the wild. Nonetheless, because a stale threshold can lead to unexpected crashes in production, remedial action is advised.

All Linux kernel hosts with the KVM virtualization stack on x86 processors are affected, especially those running on older hardware or in nested environments that disable virtual‑interrupt delivery, such as Hyper‑V. Hosts retaining the legacy path without updating the CR8 intercept logic are vulnerable; version information for the affected kernel releases is not enumerated in the advisory.

The EPSS score of < 1 % and the absence from KEV indicate a low probability of observed exploitation. The CVSS score of 5.5 reflects moderate severity, dominated by a denial‑of‑service impact. The attack requires a precise internal state transition—altering the guest’s PPR without triggering an event—making exploitation difficult from a remote context. As such, the overall risk is moderate but mitigable by patching to incorporate the corrected CR8 intercept logic.