The Linux kernel’s KVM module for x86 creates a child shadow page by inheriting the parent page’s role, but the role.invalid flag is not cleared. This violates KVM’s invariant that invalid pages must never be on the active MMU list, and when the kernel later processes the page with __kvm_mmu_prepare_zap_page the incorrect use of list_add instead of list_move causes a use‑after‑free of the page descriptor. Based on the description, it is inferred that an attacker could potentially trigger this use‑after‑free to corrupt kernel memory.

The flaw resides in the Linux kernel’s KVM implementation for the x86 architecture and affects any kernel release that has not incorporated the patch that clears role.invalid during child shadow page creation. Version details are not specified, but all vulnerable x86 hosts running KVM before the fix are impacted.

The CVSS score of 9.3 indicates a high severity use‑after‑free that could lead to kernel memory corruption and arbitrary code execution in the host. The EPSS score of < 1% suggests that, as of now, the likelihood of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector, inferred from the description, involves an attacker with control of a guest virtual machine that can manipulate shadow page mapping to trigger the flaw.