The vulnerability arises from the Linux kernel’s handling of nested virtualization. The check that guarantees the virtual task priority regulator (vTPR) matches the vmcs12.tpr_threshold was originally postponed to a late stage of VM initialization, which can leave the guest’s logical control register (CR3) in an unintended state when extended page table (EPT) is disabled. As a result, KVM may run the guest with a CR3 pointer owned by the guest rather than the host, giving the guest access to host memory and privilege escalation opportunities. This problem is a consequence of improper validation.

Affected systems are any Linux kernel deployment that uses KVM for virtualization prior to the commit that moved the consistency check into the normal path. The advisory does not list specific release numbers but references commit hashes that appear in kernel releases before the patch was applied. Therefore, all distributions running a kernel version that lacks those commits are potentially impacted.

The CVSS score of 7.8 indicates high severity, but the EPSS score of < 1% and absence from the CISA KEV catalog suggest a currently low exploitation likelihood. Nonetheless, the flaw operates within privileged KVM code and could be leveraged by a malicious nested VM when EPT is disabled, making the risk moderate for environments that rely on nested virtualization. The attack vector is inferred to involve a guest that triggers the delayed consistency check, so an attacker with control over a nested VM could exploit this flaw.