During the time KVM’s shadow page tables are walked, a race condition can cause the kernel to attempt to traverse a dummy root that points to the zero page. If the race aligns, the walk dereferences a NULL pointer, leading to a kernel OOPS and crash. The crash occurs in kernel mode from user‑level QEMU processes that use /dev/kvm. A locally‑privileged attacker can trigger this condition repeatedly, causing a denial of service on the host or potentially enabling privilege escalation if the crash can be leveraged to deduce kernel memory contents.

All Linux kernel builds that include the KVM driver for x86, regardless of vendor, are affected until the kernel is upgraded to a version that incorporates the fix from the referenced commit. The issue manifests when shadow walk occurs during memslot creation races with stage‑2 page faults such as EPT violations.

The CVSS score of 4.7 indicates moderate severity, and the EPSS score of <1% reflects a very low probability of exploitation. The NULL pointer dereference can still lead to a kernel crash, impacting the entire host system. The likely attack vector is a local user who can run QEMU/KVM, such as via SSH or a local service, manipulating page tables or memory allocation to provoke the race. This vulnerability is not listed in CISA’s KEV catalog, but the impact warrants immediate remediation.