KVM device ioctls that read or write IMSIC attributes are not serialized against the KVM_RUN operation. During a virtual CPU migration, the ioctl can capture the physical CPU and IMSIC virtual interrupt file address before the migration releases it. The address may then be reallocated to another vCPU before the attribute operation completes. When the ioctl subsequently accesses the stale address, it may read from or write to the new owner’s interrupt file, potentially causing incorrect interrupt handling or accidental data leakage.

This flaw exists in the Linux kernel on RISC‑V platforms that implement the KVM hypervisor with IMSIC support. All kernel releases prior to the inclusion of the serialization patch are affected; explicit version numbers are not listed in the advisory.

The CVSS score of 7 indicates medium severity, and the EPSS score of <1% indicates a very low probability of exploitation. Based on the description, it is inferred that an attacker would need local privileged access to the KVM host to invoke the affected ioctl and coordinate it with a concurrent vCPU migration. No remote exploitation path is described, and the flaw is not listed in the CISA KEV catalog. Consequently, reliable exploitation is difficult and the overall risk to most systems is low.