Linux Kernel EUVD-2026-93211

Requires a PowerPC Book3S HV host running KVM with nested virtualization in use, and the attacker must control an L1 guest capable of issuing tlbie instructions (single-LPID, is=2/ric=2) to drive kvmhv_remove_nested()/kvmhv_release_nested() and free the kvm_nested_guest. Exploitation is a timing-dependent race: the attacker's free on one vCPU must land in the window after another vCPU drops mmu_lock in kvmhv_emulate_tlbie_all_lpid() but before it dereferences the pointer. Limiting factors: no remote vector (local L1-guest access only, PR:L), PowerPC-architecture-only, nested KVM must be enabled, and winning the race window is non-trivial (timing-dependent). Does not affect non-PPC or non-nested KVM deployments.

Signals are mixed and point to a serious-but-narrow issue. The CVSS 3.1 base score is 8.8 (vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), driven by the scope change (S:C) representing an L1 nested guest corrupting host-kernel memory with full C/I/A impact - effectively a guest-to-host escape primitive. However, EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, so this is not currently a mass-exploitation threat. The vector's AC:L is questionable: the description is explicitly a race condition (a concurrent vCPU must free the kvm_nested_guest in a specific window), which in practice raises attack complexity - this analysis assesses AC:H. The realistic risk is a privileged, local attacker who already controls an L1 guest on a PowerPC Book3S HV KVM host with nested virtualization; against that specific configuration a reliable UAF is high-impact, but the affected code path is PowerPC-only and nested-KVM-only, so this is a targeted/specialized concern rather than a broad enterprise priority. Note the 'Information Disclosure' tag understates the issue - a UAF of host kernel structures implies memory corruption and potential host code execution, not merely disclosure.

A malicious or compromised L1 guest on a PowerPC (Book3S HV) KVM host with nested virtualization enabled issues a single-LPID tlbie (is=2, ric=2) on one vCPU while another vCPU iterates the nested-guest IDR in kvmhv_emulate_tlbie_all_lpid(); the race frees the kvm_nested_guest (gp) while it is still in use, and subsequent accesses to gp->tlb_lock, gp->shadow_pgtable, and gp->l1_host touch freed memory. No public exploit exists, but the free path is fully L1-controlled, making the race attacker-triggerable.