The Linux kernel KVM module contains a race condition where an asynchronous page fault flag is not preserved across an NMI interrupt. If an NMI occurs after an async #PF is queued but before the kernel has cleared its flag, the NMI handler will consume and clear the flag of the original fault. When the interrupted handler completes, it finds the flag cleared and panics, causing a kernel crash. This flaw is a classic race condition (CWE-362) that results in a denial‑of‑service by crashing the host or a guest VM. The crash occurs locally inside the kernel and does not provide remote code execution.

Linux Kernel (no specific version list is supplied). All versions of the kernel that lack the fix for async #PF handling in NMI context are affected; the patch was tested in kernel revisions 6.18 and the 7.3‑rc series. The vulnerability can manifest when KVM hosts process NMI interrupts or when the host’s perf subsystem samples with user call chains while an async #PF is pending.

The exploitability is low to moderate, requiring precise timing as the flaw is triggered by a race between an async #PF and an NMI. Attacker control over the timing is difficult and the vulnerability is local to the kernel; therefore no remote exploitation is known. The exploit leads to a kernel panic, so the severity is high only if the affected host is a production system. CVSS, EPSS and KEV metrics are not available; the risk stems from the potential for repeated kernel crashes in environments running KVM and perf with user call chains.