Freeing the shadow VMCS immediately after VMCLEAR removes the memory that holds the Virtual Machine Control Structure. Because this action can race with the __loaded_vmcs_clear() routine, the kernel may attempt to execute VMCLEAR on a freed page. This use‑after‑free can corrupt kernel memory and give an attacker the ability to execute arbitrary code in the host or crash the virtualization layer, resulting in a denial of service.

An affected system is any Linux host running the Kernel that incorporates the KVM virtualization layer for Intel VMX. The vulnerability is present in the current kernel code paths for KVM's nVMX handling; the patch series is already merged into the mainline tree. All distributions shipping unpatched kernel versions are at risk.

With no EPSS metric available, the likelihood of exploitation in the wild cannot be quantified, but the bug is a classic use‑after‑free that can be triggered by a malicious virtual machine exploiting a race. The CVSS score is not provided, and the vulnerability is not yet catalogued by CISA. An attacker would need control over a guest VM and the ability to time the freeing of the shadow VMCS while __loaded_vmcs_clear() is executing; if successful, host compromise or service interruption would ensue.