Linux Kernel KVM EUVD-2026-48995

Exploitation requires: (1) a 64-bit Linux kernel running KVM with the guest_memfd feature present (kernels >= 6.8, compiled with CONFIG_KVM_GMEM); (2) the attacking process must have read-write access to /dev/kvm, which on most distributions is restricted to the 'kvm' group or root - unprivileged users without group membership cannot trigger the vulnerable ioctl; (3) the attacker must craft a memslot binding request with an offset value sufficiently close to INT64_MAX that adding the (bounded) size causes a signed 64-bit integer wraparound. High complexity (AC:H) reflects this crafting requirement. Exploitation is NOT possible on kernels prior to 6.8 (guest_memfd did not exist), on 32-bit kernels (different integer semantics), when KVM is not loaded, or when the user lacks /dev/kvm access. The limiting factors - group-restricted device access and the niche guest_memfd feature - significantly reduce realistic exposure compared to the raw CVSS score.

The CVSS 3.1 score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the risk profile: local access with low privileges is required, complexity is high due to the need to craft a specific near-maximum offset value, but successful exploitation yields full C/I/A impact. The Scope:Unchanged designation is significant - the impact is confined to the vulnerable kernel, not an escape to host from guest. EPSS at 0.22% (13th percentile) signals that automated or widespread exploitation is not anticipated, and there is no CISA KEV listing confirming active exploitation. The combination of high complexity, local-only access, and reliance on the relatively recent guest_memfd feature (Linux 6.8+) substantially limits realistic attacker population. That said, this class of integer overflow in a hypervisor memory-binding path is precisely the type of primitive that a sophisticated adversary targeting confidential computing environments (TDX/SNP) would seek to weaponize. The low EPSS should not be taken as a signal that the vulnerability is unimportant in KVM-heavy environments - rather, it reflects the niche attacker profile required. No CVSS/description conflict detected; the local vector is consistent with the requirement for direct access to /dev/kvm.

An attacker with a local shell on a KVM hypervisor host (e.g., via a compromised guest escape or a user account in the 'kvm' group) crafts a KVM_SET_USER_MEMORY_REGION2-class ioctl that supplies a guest_memfd binding offset near the maximum positive signed 64-bit value (e.g., INT64_MAX - 1). When KVM computes offset + size, the addition wraps to a negative signed value, which is smaller than the inode's file size, allowing the otherwise-rejected binding. The attacker can then access or corrupt kernel memory regions outside the intended guest_memfd allocation, potentially escalating privileges or destabilizing the hypervisor. No public POC code has been identified at time of analysis, making this scenario currently limited to researchers or highly capable adversaries.