The vulnerability is a failure to release secure device pages in KVM's PowerPC Book3S hypervisor. When a page‑in operation fails after the underlying UV page has been allocated, the allocated secure page is left unreleased, leaving an entry in the firmware‑bounded secure memory pool and marking the guest‑physical frame number as permanently secure. As the leak is per allocation, repeated failures can cumulatively consume all available secure memory for the VM, leading to allocation failures and effectively a denial‑of‑service. This is a resource‑management flaw (CWE‑772) with impact limited to consume secure memory.

All Linux kernel implementations of KVM for PowerPC 9 and 10 processors that run the Ultravisor or PEF firmware are affected. The issue is confined to the Book3S hypervisor code path that handles secure device page allocation via uv_page_in() in kvmppc_svm_page_in(). No specific kernel version numbers are provided in the advisory, so any kernel supporting that code will be compromised until the upstream patch is applied.

The CVSS score of 2.5 indicates a low severity impact. The EPSS score is not available, and the vulnerability is not present in CISA's KEV catalog. Exploitation requires triggering a uv_page_in() failure, which can happen by intentionally exhausting the firmware‑bounded secure memory pool or causing allocation errors within the VM. A malicious guest or host administrator with control over memory allocation could repeatedly exploit the fault, each time consuming a secure memory entry and permanently making a guest‑physical frame unusable. Over time, this could exhaust the secure memory pool and prevent further secure allocations for the VM, causing a denial‑of‑service situation. The likely attack vector is internal, requiring direct access to the affected virtual machine or hypervisor configuration.