Linux Kernel EUVD-2026-108933

Exploitation requires an attacker-controlled KVM/x86 guest whose vCPU uses System Management Mode (SMM / KVM address space 1), and the damaging host path depends on nested virtualization using EPT (the affected GFN page backing a nested EPT table). The concrete trigger is an update to the SMM memslots while a per-vCPU MMIO cache entry filled against the old SMM address space is still considered valid, so that returning to the normal address space leaves a stale cache entry that misroutes a valid-RAM access to userspace as KVM_EXIT_MMIO. Per the CVSS vector (PR:L), this needs authenticated local access at guest-privilege level on the host - it is not remotely exploitable. Limiting factors: guests that never enter SMM, hosts not performing SMM memslot updates, and configurations without nested EPT are not realistically affected, substantially narrowing exposure despite the high base score.

Signals diverge, so this is a genuine but not emergency-grade priority. The CVSS base score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is driven by the scope change (S:C) and triple-High impact, reflecting that a guest can cross the KVM boundary and corrupt or disclose host-side memory - not a purely network-exploitable flaw. The attack vector is Local (AV:L): exploitation requires control of a KVM guest vCPU on the host, not remote reach. Counter-signals are strong: EPSS is only 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit reference appears in the input (only in-tree kernel selftests, which are regression tests, not weaponized PoCs). The vuln.today decision label is 'this_week', consistent with a serious-but-not-critical, patch-within-the-week cadence rather than 'act_now'/'emergency'. Note two tensions to verify: the 'Information Disclosure' tag understates the integrity impact - the description details a path where the host writes a backing page outside KVM's write-tracking and then keeps using stale nested-EPT shadow translations, which is host memory corruption, not merely disclosure; and the high CVSS is heavily conditioned on a specific KVM configuration (SMM plus nested EPT), so real-world exposure is narrower than the score alone implies.

An attacker who already controls a virtual machine on a KVM/x86 host drives the guest into System Management Mode and populates the per-vCPU MMIO cache against SMM address space 1, then triggers an update to only the SMM memslots. After the vCPU returns to the normal address space, a subsequent access to valid RAM at the same GFN is wrongly reported to userspace as KVM_EXIT_MMIO; completing that exit writes the backing page outside KVM's write-tracking, and if the page backs a nested EPT table KVM continues using stale shadow translations, enabling host-side memory corruption or disclosure. No public exploit is identified at time of analysis; only in-tree regression/selftests are referenced.