The flaw occurs when the KVM module reloads: stale pointers to memory caches survive past an unload of a vendor module and are later passed to a cache destroy function after a failed reload. This triggers a slab use‑after‑free, a kernel‑memory corruption that can lead to a kernel crash or execution of arbitrary code with privileged rights. The vulnerability is a classic use‑after‑free (CWE‑416) and also involves improper release of kernel resources (CWE‑825).

All Linux kernels that build the KVM driver with CONFIG_KVM and provide vendor modules on x86 are affected. The generic CPE indicates that any distribution using the standard Linux kernel with KVM support on x86 hardware—and any virtualized environment running kvm_intel or similar modules—must assess their version for this flaw.

The only way to reproduce the bug is by loading and unloading kernel modules, which requires a user with module‑operation privileges. The CVSS base score of 4.1 indicates a moderate threat. The low EPSS score of < 1 % and the absence of KEV listing suggest limited exploitation in the wild, yet the kernel‑memory corruption could allow a local attacker to trigger a use‑after‑free and potentially gain arbitrary code execution with elevated privileges. Consequently, the vulnerability should be treated as medium risk until proper mitigations are deployed.