The vulnerability resides in the Linux kernel’s KVM SEV implementation. During an intra‑host migration, the host clears the SEV 'active' flag before performing a hardware cache flush on the source virtual machine. The resulting race creates a brief period in which the host can reclaim memory from the migrated VM. If the host performs a page unmap at that time the automatic cache flush is skipped, allowing the host to reclaim the memory without flushing the stale encrypted data. The stale ciphertext can then overwrite the new page owner's data, exposing sensitive guest memory to the host. This flaw is a data confidentiality issue triggered by improper cache‑maintenance sequencing.

Linux kernel running KVM with SEV (Secure Encrypted Virtualization) enabled on the host. Any virtual machine that participates in an intra‑host migration of a SEV‑enabled guest is potentially affected. The vulnerability is present on all kernel releases prior to the fix and does not depend on vendor‑specific patches.

With a CVSS score of 7.5, the flaw presents a moderate to high risk to confidentiality for KVM hosts that manage SEV‑enabled guests. The exploit requires local host privilege and concurrent migration and unmap operations, conditions that arise naturally during normal VM migrations. No public exploit is known and the EPSS score is <1%, but the mechanism is straightforward enough that a skilled adversary could craft a malicious migration scenario. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploited incidents at the time of reporting. Nevertheless, a host that can control memory reclaim operations can read or modify guest memory, which is considered a severe data exposure.