The vulnerability involves a logic flaw in KVM’s write‑tracking verification. Because page tracking is per‑address‑space and shadow pages are shared, a page flagged as write‑tracked in one address space may appear untracked in another. This mismatch causes the memory synchronizer to unsynchronize a shadow page, which can trigger a BUG in pte_list_remove(), resulting in a kernel panic. The weakness is identified as CWE-617 and CWE-670. An attacker could potentially trigger this condition by manipulating the guest’s memory tracking, leading to a denial of service.

The issue applies to any Linux kernel that includes the KVM virtualization module and has not incorporated the commit adding a second slot check in the write‑tracking code. The affected system identifiers list the Linux kernel, with specific references to kernel releases 7.2 RC1 through RC5. Consequently, any kernel build before the referenced commit logs is vulnerable. Users of virtualized hosts should verify that their kernel includes the patch.

The CVSS score of 7.1 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to influence the guest’s write‑tracking status, which would typically require manipulating the guest’s memory tracking mechanisms. This generally limits the threat to scenarios where an attacker can operate within a virtual machine with sufficient privileges to affect KVM’s address‑space handling.