A high-severity bounds-checking vulnerability in the Linux kernel KVM hyper-v subsystem allows local attackers to cause memory corruption and system denial of service.

This is an out-of-bounds read and use-after-free flaw in the Kernel-based Virtual Machine KVM hyper-v implementation, triggered when querying sparse banks with an unchecked virtual processor ID requiring low-privileged user authentication.

A successful exploit can lead to localized denial of service and sensitive information leakage within the hypervisor infrastructure, impacting multi-tenant host stability. With a CVSS score of 8.4, the vulnerability poses a significant risk to virtualized environments, potentially compromising the confidentiality and availability of guest workloads running on the affected hypervisor node.

Immediate Action: Update the Linux kernel to version 6.6.144, 6.12.95, 6.18.38, 7.1.3, or later depending on the active release branch.

Proactive Monitoring: Monitor system logs for kernel panics, KASAN reports, and unauthorized local process executions or resource anomalies.

Compensating Controls: Restrict local shell access and ensure strict least-privilege principles are enforced for all user accounts on the host system.

Public Exploit Available: No - unknown

Administrators must prioritize updating vulnerable Linux kernel packages across all affected virtualization hosts. Applying the official kernel patches is essential to eliminate the underlying memory management defect and prevent potential host destabilization.