The flaw lies in the Linux kernel’s KVM nested virtualization code, where the VMCS MSR bitmap is not refreshed when runtime eVMCS controls are changed. As a result, the host’s Thermal Processing Register (TPR) can remain in passthrough mode even after TPR virtualization is disabled. This residual passthrough allows a guest or its nested guest to read or modify the host’s TPR register, potentially influencing host scheduling, power management, or creating a foothold for further exploitation. The impact is increased privileges for the guest and a breach of isolation between virtual machines.

The vulnerability applies to Linux systems using the kernel KVM hypervisor with nested virtualization enabled. Both vendor identifiers "Linux:Linux" indicate the Linux kernel; the specific kernel patches or versions are not listed, so any active kernel build that includes the affected KVM code is susceptible. Systems that run nested guests without proper TPR virtualization handling are at risk.

The CVSS score of 5.3 signifies a moderate severity, but the vulnerability allows a powerful escalation vector within the hypervisor boundary. The EPSS score of < 1% indicates a very low probability of public exploitation at the time of this analysis, and the issue is not present in the CISA KEV catalog. Exploitation would require an attacker who controls a nested guest (L2) that modifies eVMCS controls while the host’s L1 does not intercept TPR writes. Under those conditions, the guest could read or alter host TPR, undermining isolation and potentially enabling further attacks.