The issue occurs when the delayed I/O APIC End‑of‑Interrupt work is cancelled after the virtual CPUs have already been destroyed. The cancellation code later dereferences memory that has been freed, causing a use‑after‑free in the kernel. This memory corruption can corrupt critical kernel data structures and potentially give an attacker the ability to execute code with kernel privileges. The flaw is present in the arch/x86/kvm/lapic.c and arch/x86/kvm/ioapic.c paths, and the affected code is linked to the KVM subsystem that handles I/O APIC emulation. The vulnerability is categorized as CWE‑125.

All Linux kernel releases that ship the legacy KVM I/O APIC handling code and have not yet incorporated the 7.1.0‑rc7 fix are affected. The vulnerability resides in arch/x86/kvm/ioapic.c and any kernel version that exposes the I/O APIC feature to KVM virtual CPUs falls under the affected set. Distributions such as Ubuntu 25.10 using the 7.1.0‑rc7 kernel are specifically mentioned, and any other distributions with identical or older unpatched kernels are likewise impacted.

The CVSS score of 9.3 denotes a critical severity for this kernel memory corruption flaw. The EPSS score is less than 1%, indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog, so no publicly known exploits exist. Based on the description, it is inferred that the attacker must have the ability to orchestrate VM lifecycle events—specifically, trigger the destruction of a virtual machine while I/O APIC work is still pending—to exploit the use‑after‑free path. This requires local or privileged access to the host to control KVM, making the attack vector likely local. Therefore, while exploitation is unlikely, the potential impact is high if an attacker can satisfy these conditions.