kvm_io_bus_get_dev() returns a device matched only by its address, without checking the expected type. If the matched device is freed before the caller inspects it, the reference becomes dangling, creating a use‑after‑free scenario that can corrupt memory or trigger a kernel panic within the KVM subsystem.

All Linux kernel versions that contain KVM and have not applied the commit that moves SRCU locking responsibility to callers. The specific kernel releases are not listed, so any kernel prior to that fix on a host running KVM is potentially affected.

The flaw is a local security issue that requires the attacker to execute code within the host or a virtual machine that interacts with KVM. No public exploits are known and the EPSS score indicates a low probability of exploitation (<1%). The CVSS score is 7.8. The vulnerability is not registered in CISA KEV. The likely attack vector involves calling kvm_io_bus_get_dev() without holding the SRCU lock, leading to a use‑after‑free and possible arbitrary memory writes or a crash.