A high-severity race condition in the Linux kernel KVM nested virtualization subsystem allows for potential memory corruption and host system instability.

This is a use-after-free vulnerability in the nVMX component of the KVM driver, occurring due to improper synchronization during the freeing of a shadow VMCS, which requires local authenticated access.

With a CVSS score of 8.8, this vulnerability poses a severe risk to host systems supporting nested virtualization. Exploitation could result in kernel memory corruption or unauthorized host access. The primary business impact includes potential host system crashes, denial of service for hosted virtual machines, and the possibility of privilege escalation for attackers capable of triggering the race condition.

Immediate Action: Update the Linux kernel to version 6.6.148, 6.12.101, 6.18.42, 7.1.6, or apply the upstream fix commit af56298e9d86e6098cd1d2e155cb2949b7c45412.

Proactive Monitoring: Review system logs for kernel-level errors related to KVM or nested virtualization operations.

Compensating Controls: Disable nested virtualization on host kernels if it is not strictly required for business operations to eliminate the attack surface.

Public Exploit Available: Unknown.

Security teams should treat this vulnerability with high urgency, particularly in environments utilizing nested KVM virtualization. Applying the recommended kernel updates is the only effective way to neutralize the race condition and prevent potential host-level memory corruption.