The CVE describes a use‑after‑free vulnerability in the Linux kernel’s KVM PowerPC Book3S hypervisor. During a nested TLB flush, the code iterates a nested‑guest IDR and releases mmu_lock before holding a reference to the nested‑guest structure. A concurrent virtual CPU can race through the flush and removal sequence, freeing the structure while it is still being accessed. The exploit path dereferences freed memory in the host kernel, which can lead to arbitrary code execution at kernel privilege level.

All Linux kernel KVM deployments running on PowerPC Book3S hardware that lack the commit adding a reference count for the nested‑guest structure are vulnerable. No specific kernel version range is published, so any kernel built without the patch commit is considered affected. The vulnerability applies to Linux:Linux vendor products across CPEs, and both known CNA vendor references listed.

The CVSS score of 8.8 reflects high severity. The EPSS score of <1% suggests a very low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Nevertheless, exploitation requires a privileged environment where a malicious nested guest can control the timing of TLB flush operations, which is typically restricted to host administrators or trusted tenants. If an attacker can induce the race condition, the use‑after‑free could crash the kernel or allow arbitrary code execution at the host level.