A critical security flaw exists in the Linux Kernel KVM SEV subsystem that could lead to full system compromise if exploited by a local attacker.

This is a memory safety issue within the KVM SEV component where Port I/O requests of length zero were not explicitly ignored, leading to potential integer underflow during scratch area configuration. The vulnerability requires no authentication and can be triggered by a local attacker to achieve system-wide impacts.

The vulnerability carries a CVSS score of 9.3, classifying it as critical due to the potential for complete loss of confidentiality, integrity, and availability. Successful exploitation allows a local attacker to escape the guest environment or compromise the host kernel, resulting in unauthorized data access, system instability, or full control of the underlying infrastructure.

Immediate Action: Update the Linux Kernel to versions 6.12.95, 6.18.35, 7.0.12, or later as appropriate for your specific distribution branch.

Proactive Monitoring: Monitor system logs for kernel panics, unexpected reboots, or suspicious activity originating from virtualized guest environments.

Compensating Controls: Restrict access to the virtualization host and ensure that only trusted users have the ability to execute code within guest environments, as the attack vector is local.

Public Exploit Available: No

Given the critical CVSS severity and the potential for privilege escalation and guest-to-host escapes, this vulnerability should be prioritized for patching. IT administrators must verify their current kernel versions and apply the upstream patches provided by the Linux kernel maintainers as soon as they are integrated into their respective distribution's stable update channels.