The flaw is a double‑free of the have_run_cpus mask within the SEV guest initialization code of KVM, an error that corrupts kernel memory and can be leveraged to execute code with kernel privileges or cause a crash. The exploitation vector hinges on creating or interfering with a SEV guest that triggers failure in __sev_guest_init(), causing the mask to be freed twice. This results in unpredictable memory corruption and the potential for privilege escalation on the host.

Linux kernels that include the SEV module and have not been patched to nullify the have_run_cpus mask pointer when freeing it. Distributions that ship kernels with SEV enabled and lack the commit that adds the fix are vulnerable. No specific version information is supplied, so any kernel build that loads the sev module without the patch is considered affected.

Without an applied kernel patch, any process able to create a SEV guest on the host can trigger the double‑free path. The EPSS score indicates a very low probability of exploitation (<1%, approximately 0.00166), but the CVSS score of 5.5 indicates a moderate severity. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation, yet the potential for kernel code execution warrants immediate patching.