The flaw occurs in the Linux kernel’s KVM SVM virtualization path when a physical CPU is cycled offline and back online. The code that assigns Address Space Identifiers (ASIDs) resets the ASID generation counter to 1 instead of incrementing it, allowing a virtual CPU that remains unscheduled during the hotplug cycle to resume on the same CPU with an ASID that has already been reassigned to a different virtual CPU. This collision causes stale Translation Lookaside Buffer (TLB) entries to be used, resulting in internal errors that manifest as NPT page faults with faulting guest physical addresses far outside the VM’s memory limits. The emulator then fails to emulate the affected instructions, ending in a KVM internal error that can boot the VM or kill the virtual machine entirely. The vulnerability does not grant direct code execution, but it can lead to unexpected termination or corruption of VM state, effectively a denial of service for the affected virtual machines.

All Linux kernel builds that implement KVM SVM virtualization are potentially affected, as the bug is present in the generic KVM module without any version restriction listed. Because the issue involves the handling of ASID generation during CPU hotplug events, any environment that uses Linux with KVM and experiences hotplugging of CPUs may be exposed. No specific product or release numbers are documented in the advisories.

The CVSS score is 5.6, indicating a moderate severity, and the EPSS score is <1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The exploitability hinges on an attacker’s ability to trigger a CPU hotplug cycle while one or more virtual CPUs remain unscheduled or blocked on the CPU that is reactivated. The effect is a crash or forced failure of the affected VM or the hypervisor’s emulation layer rather than arbitrary code execution on the host. In environments that rely on CPU hotplug for capacity management or fault tolerance, the failure could impact service availability. The lack of a KEV listing suggests no current widespread exploitation, but the high potential for disruptive impact warrants prompt attention.