The flaw arises when KVM on ARM64 frees shadow S2 structures before a virtual machine is fully destroyed. This premature deallocation can leave the container still referenced elsewhere, creating a classic use‑after‑free scenario. Based on the description, it is inferred that if an attacker can trigger this path, they could corrupt kernel memory, potentially causing a crash or, in worst cases, enabling arbitrary code execution at the kernel level.

The issue affects Linux kernel deployments that use KVM virtualization on ARM64 hardware. Any kernel version prior to the update that implements delayed freeing of shadow S2 structures is susceptible. Specific version information is not provided, so all affected ARM64 KVM installations should be reviewed.

No CVSS score is available, and the EPSS score is not listed, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not present in CISA’s Known Exploited Vulnerabilities catalog. Nonetheless, use‑after‑free bugs in the kernel can be highly dangerous; based on the description, it is inferred that exploitation would likely require local or privileged access to the hypervisor, but no public exploits are documented at this time.