The Linux kernel’s KVM hypervisor has a flaw where an in-use MMU root page can be marked invalid or obsolete while still referenced for page translations. When the system attempts to map memory into such a root, child shadow pages inherit the invalid status, violating KVM’s invariant that invalid pages are never active on the list of active MMU pages. This can lead to memory corruption or a kernel crash within the virtual machine and may compromise the host’s stability. The weakness corresponds to CWE-825.

Affected systems are all Linux kernel builds that include the KVM hypervisor and that lack the patch introduced after commit 0026dbb7de8ea76e97d6edf42fc3cc084564e2bf. Distributions running kernels prior to this commit, as well as any custom kernels that have not applied the fix, are vulnerable.

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% and the absence of listing in CISA KEV suggest a low current exploitation probability. No public exploits are known. Based on the description, it is inferred that exploiting this flaw would likely require the attacker to have elevated or privileged local access in order to manipulate KVM memory structures. The main risk therefore is the potential for denial of service or instability within virtual machines on the host.