The flaw arises in the Linux kernel’s KVM nVMX module where free_nested() deallocates a shadow VMCS while vmcs01 still points to it. Because this deallocation occurs asynchronously relative to loaded_vmcs_clear(), a virtual CPU may migrate before the pointer is cleared and __loaded_vmcs_clear() can then attempt to execute VMCLEAR on a page that has already been freed. This use‑after‑free can corrupt kernel memory or allow execution of arbitrary code in the host context. The issue involves a race condition between deallocation and clear operations.

Any Linux host that runs the mainline kernel with the KVM virtualization layer enabled for Intel VMX is affected. The vulnerability is confined to the default KVM code path for nested virtualization (nVMX); distributions shipping an unpatched kernel that includes this legacy cleanup logic are vulnerable. Hosts that do not run KVM or have Intel VMX support disabled are not impacted.

The CVSS score of 8.8 places the vulnerability in the high severity category. Its EPSS score of < 1% indicates a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. Nevertheless, the defect can be triggered by a privileged guest VM that can time the release of the shadow VMCS against an ongoing __loaded_vmcs_clear() operation. Successful exploitation would allow the guest to corrupt the host kernel or crash KVM, resulting in host compromise or denial of service. The attack vector is internal to the hypervisor, requiring control of a guest on the affected host.