The vulnerability arises from the Linux kernel's KVM module that manages AMD's Secure Virtual Machine (SVM). When a VMRUN instruction fails, the kernel fails to update certain control fields in the VMCS. As a result, the guest continues with stale or incomplete settings, potentially producing incorrect behavior or state leakage. The flaw reflects improper error handling (CWE-252) and can culminate in malfunction of virtualized workloads.

Affected systems are Linux distributions running a kernel containing the unpatched SVM implementation on AMD hardware. The issue resides in the KVM module, so any kernel version prior to the fix is susceptible. Based on the information, it is inferred that the lack of specific kernel releases indicates the risk spans all unpatched kernels on AMD platforms.

The CVSS score of 5.6 and an EPSS below 1 % signal a moderate severity with a very low likelihood of exploitation. The flaw is not listed in CISA KEV, indicating no known active exploitation. Based on the description, it is inferred that successful exploitation would require control over a virtual machine to induce a VMRUN failure, a condition unlikely to be feasible for remote attackers.