A high-severity use-after-free vulnerability in the Linux kernel KVM virtualization subsystem creates a risk of guest-to-host escape and host-level privilege escalation.

This is a use-after-free vulnerability located in the KVM shadow memory management unit (MMU) page fault path, requiring an authenticated local user or a privileged guest workload to trigger.

The CVSS score of 8.8 reflects the high risk of this vulnerability. Successful exploitation could allow an attacker to escape a virtualized environment, gaining unauthorized root access to the underlying host system. This represents a critical threat to multi-tenant cloud environments and virtualized infrastructure, potentially leading to total system compromise, data theft, and loss of service integrity.

Immediate Action: Update the Linux kernel to version 6.6.148, 6.12.101, 6.18.42, 7.1.6, or apply the upstream fix commit 35e77467610c4a37cb0ff54ee56b85f73b1f5700.

Proactive Monitoring: Monitor host system logs for abnormal KVM kernel panics or unexpected memory access errors associated with virtual machine operations.

Compensating Controls: Restrict access to virtualization capabilities, such as KVM guest creation, to highly trusted users only, as local access is a prerequisite for exploitation.

Public Exploit Available: Yes, a public proof-of-concept exists.

Given the potential for host compromise and the existence of a public proof-of-concept, this vulnerability poses a significant risk to virtualized environments. Administrators should prioritize patching the Linux kernel on all host systems running KVM to prevent potential guest-to-host escapes.