A memory management vulnerability in the Linux kernel KVM subsystem for LoongArch processors could allow a local authenticated attacker to achieve full system compromise.

The vulnerability exists in the kvm_arch_prepare_memory_region function, which fails to preserve memory slot architecture flags during specific memory region updates. This allows an attacker with local user privileges to bypass alignment checks and trigger incorrect host page mapping, leading to memory corruption or unauthorized access.

The exploitation of this vulnerability poses a severe risk to multi-tenant environments or systems utilizing KVM virtualization. A successful exploit could allow a guest process to access or modify arbitrary host memory, resulting in total system compromise, data theft, or complete service disruption. Given the CVSS score of 8.8, this flaw is categorized as high severity and requires immediate attention to protect the integrity of the host OS and guest isolation.

Immediate Action: Apply the latest kernel security updates provided by your Linux distribution, ensuring the kernel is updated to at least version 6.12.110, 6.18.51, or 7.2.5 depending on your specific branch.

Proactive Monitoring: Monitor system logs for unusual kernel panics or unauthorized attempts to manipulate KVM memory regions.

Compensating Controls: Restrict access to virtualization management interfaces and limit the ability of non-privileged users to interact with KVM-related ioctls.

Public Exploit Available: Unknown

System administrators managing Linux-based hypervisors on LoongArch hardware must prioritize updating their kernel packages to the versions listed above. Because this flaw affects the fundamental memory isolation mechanisms of the hypervisor, failure to patch leaves the host and all hosted virtual machines vulnerable to privilege escalation and data compromise. Verify successful application of the patch by checking the kernel version string after rebooting the affected hosts.