In the Linux kernel’s KVM x86 module, when the request to fetch nested state pages fails, the GET_NESTED_STATE_PAGES flag is not cleared before control returns to user space. If a guest later re‑runs the vCPU, the kernel may re‑enter the nested VM using the stale, unpinned physical frame numbers that were left in the vmcs02 structure from a previous run. This erroneous reuse of page table entries can expose memory that should no longer belong to the guest, potentially allowing data leakage or memory corruption. The flaw represents an improper cleanup of nested page state and aligns with CWE-825.

All Linux distributions that ship the upstream Linux kernel with KVM support for x86 are impacted, regardless of vendor or distribution name. The vulnerability exists in every kernel build that contains the KVM x86 code path where the GET_NESTED_STATE_PAGES request might fail and is not correctly cleared. There is no specific version restriction beyond kernel versions lacking the commit that re‑queues the request.

The EPSS score of 0.00154 (approximately 0.15%) indicates a low but nonzero likelihood of exploitation; the vulnerability is not listed in KEV. The vulnerability requires a privileged host or a user capable of running nested virtual machines. An attacker would need to trigger a nested‑VM run that fails to obtain pages, then re‑run the vCPU to exploit stale mappings. Although indirect, the risk of data leakage or corruption can be significant in environments that allow nested virtualization or host the same physical machine for multiple guests. Given the potential impact on guest isolation, timely patching is recommended.