The vulnerability arises when the Linux kernel’s KVM SEV module frees a CPU mask during virtual‑machine destruction even if the VM has migrated to a non‑encrypted state. This incorrect deallocation is a classic use‑after‑free situation that can corrupt kernel memory or expose sensitive data. The main consequence is potential host crashes, instability, or data leakage, impacting availability, confidentiality, and integrity of the host system.

Linux operating systems that compile the upstream kernel with SEV support are affected, regardless of distribution. Since the vulnerability is tied to the SEV code path, any kernel that enables SEV encryption for its guests will contain the defect. No specific version is listed, so all current kernels that support SEV should be considered vulnerable until a patch is applied.

The CVSS base score is 3.3, indicating low severity. The EPSS score is reported as < 1%, suggesting a very low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation would require influence over VM destruction or intra‑host migration, typically a local privileged user or a malicious guest capable of triggering the faulty path. Given the low score and lack of public exploits, the overall risk is considered low to moderate, but in environments running SEV VMs the vulnerability still poses a potential risk to availability and memory integrity.