The flaw arises when KVM on ARM64 frees shadow S2 structures before a virtual machine is fully destroyed. This premature deallocation can leave the container still referenced elsewhere, creating a classic use‑after‑free scenario. Based on the description, it is inferred that if an attacker can trigger this path, they could corrupt kernel memory, potentially causing a crash or, in worst cases, enabling arbitrary code execution at the kernel level.

The issue affects Linux kernel deployments that use KVM virtualization on ARM64 hardware. Any kernel version prior to the update that implements delayed freeing of shadow S2 structures is susceptible. Specific version information is not provided, so all affected ARM64 KVM installations should be reviewed.

The CVSS score of 7 indicates a high severity vulnerability. The EPSS score of <1% reflects a very low probability of exploitation in observed traffic, and the vulnerability is not listed in CISA KEV. The use‑after‑free flaw can lead to memory corruption that could cause a kernel panic or potentially be leveraged for privileged escalation if an attacker gains execution within the hypervisor context. The attack would likely require local or privileged access to the KVM environment, as the flaw resides in the ARM64 KVM shadow page management code. No public exploits are currently known.