A race condition exists in the Linux kernel's mshv hypervisor interface between the publishing of a virtual processor (VP) structure into the pt_vp_array and the interrupt service routine (ISR) that can read this array without synchronization. When an irqfd is registered for a VP that has not yet been fully created, a concurrent ISR may observe a partially initialized VP pointer, leading the ISR to use incomplete fields such as vp_register_page. This flawed read can corrupt kernel memory or potentially execute unintended kernel code. Based on the description, it is inferred that the flaw could lead to kernel-level memory corruption, which might in turn enable privilege escalation if an attacker can trigger and control the race.

All Linux kernel builds that include the mshv hypervisor implementation are potentially vulnerable. The specific affected versions are not enumerated in the advisory, so any kernel that implements the current mshv architecture and exposes the irqfd interface is at risk until a patch is released.

The advisory does not provide a CVSS score, and the EPSS data is unavailable, suggesting no widely publicized exploitation. The flaw requires a user to register an irqfd for a non-existent VP and to trigger the fast path ISR concurrently with VP creation, which is generally a local privilege scenario. Because the vulnerability is not listed in the CISA KEV catalog, the current threat level is low to moderate, but if an attacker is able to satisfy the conditions the risk could elevate to serious kernel compromise.