A race condition between the hrtimer callback and the teardown of a RISC‑V virtual CPU in the Linux kernel KVM module allows a guest to trigger a use‑after‑free of kernel memory. The race is created when the guest arms an hrtimer via SBI TIME and then initiates a shutdown, while the host destroys the VM. The callback may still be executing when the vCPU is freed, leading to a slab‑use‑after‑free that KASAN reports, which can result in a kernel crash and give the attacker elevated privileges on the host. No post‑launch host ioctl is needed; the VMM simply must honor KVM_EXIT_SYSTEM_EVENT.

All Linux kernel builds for the RISC‑V architecture that include KVM and use the hrtimer callback for guest timers. The issue is present on any kernel prior to the patch that synchronizes the hrtimer cancellation during teardown.

Based on the description, it is inferred that the vulnerability has no publicly available exploit and the EPSS score is < 1%. The CVSS score of 9.3 indicates a critical severity that includes potential read/write data and local privilege escalation with the attacker having guest access. Because the flaw relies on a guest entry that is reachable in any RISC‑V KVM environment, the likelihood of exploitation remains significant for exposed hosts. Updating the kernel to the patched commit is required; staying on an older kernel keeps the risk high. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been observed in the wild, but the potential for denial‑of‑service or privilege escalation makes it a high‑priority issue.