A TOCTOU vulnerability in the Linux kernel KVM SEV subsystem could allow a local attacker to manipulate guest memory states, leading to potential system compromise.

The issue exists within the guest-accessible Page State Change buffer. By failing to use READ_ONCE, the kernel is susceptible to TOCTOU bugs, which an authenticated local attacker can leverage to influence the hypervisor state.

This vulnerability poses a high risk to virtualized environments, as it allows for the manipulation of page states within KVM. With a CVSS score of 8.8, successful exploitation can lead to a breakout from a guest environment, resulting in unauthorized access to host memory or the compromise of other guest virtual machines.

Immediate Action: Apply the vendor-supplied security patches, specifically updating to kernel versions 6.12.93, 6.18.35, or 7.0.12 as appropriate for your distribution.

Proactive Monitoring: Review virtualization host logs for unusual KVM activity or errors related to memory management and page state changes.

Compensating Controls: Ensure that guest virtual machines are isolated using robust security policies and that the host kernel is hardened against local privilege escalation.

Public Exploit Available: Unknown.

Security teams managing virtualized infrastructure must treat this vulnerability with high urgency. Patching the host kernel is the only definitive way to eliminate the window of opportunity for a TOCTOU-based attack on the Page State Change buffer.