The flaw is in the Linux kernel’s KVM subsystem. The per‑vCPU MMIO cache was keyed only on the memslot generation and ignored whether the vCPU was executing in System Management Mode (SMM) or the normal address space. When the host updated the SMM memslots, the cache could still reference an entry from the old SMM view. A guest that accessed the same guest frame number again would then trigger a KVM_EXIT_MMIO and be allowed to write to a host memory page without passing through KVM’s write‑tracking path. If that page backed a nested EPT table, KVM would continue using stale shadow translations, possibly corrupting kernel memory. An attacker can therefore use a guest to overwrite arbitrary host memory and gain privileged execution.

All Linux kernels that run KVM on x86 architecture are affected until the patch is applied. The vulnerability applies to any kernel version that contains the unpatched code referenced by commit 699023e23965 and earlier; no specific version range is given, so current-mainline kernels before the fix are considered vulnerable.

The EPSS score is <1% (approximately 0.2%) and the vulnerability is not listed in CISA’s KEV catalog, but the flaw provides a clear path for a guest to write to arbitrary host memory, which is a high‑impact ability. The CVSS severity score of 8.8 indicates high risk. Exploitation requires that the host updates SMM memslots, implying the attack must be performed from a guest VM that can trigger such changes. The risk level is therefore considered high because it gives a guest unrestricted memory write in the host environment, although practical exploitation may be constrained to environments that use SMM or nested virtualization.