A race condition vulnerability in the Linux kernel KVM subsystem could allow a local attacker to achieve full system compromise by exploiting improper synchronization during encrypted VM context operations.

This vulnerability is a race condition within the KVM SVM driver, specifically involving the KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM operations. It requires a local user with low privileges to trigger concurrent memory operations that bypass necessary locking mechanisms, leading to list corruption or invalid memory access.

The potential impact of this vulnerability is severe, as successful exploitation results in full system control, data confidentiality loss, and total availability disruption. Given the CVSS score of 8.8, this flaw is categorized as high severity because it allows a local attacker to escape or manipulate the kernel environment, posing a significant risk to virtualized infrastructure and cloud workloads.

Immediate Action: Update the Linux kernel to version 6.1.184, 6.6.153, 6.12.105, or 6.18.45 (or later) to incorporate the necessary synchronization fixes.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or crashes related to KVM operations, which may indicate attempted exploitation of these race conditions.

Compensating Controls: Restrict access to KVM-related ioctls for untrusted local users to reduce the attack surface until patches can be applied.

Public Exploit Available: Unknown.

Organizations utilizing Linux-based virtualization environments should prioritize patching their kernel to the specified fixed versions. Because this vulnerability allows for privilege escalation and cross-VM impact, it represents a significant risk to multi-tenant environments and should be addressed as part of the next standard maintenance cycle.