The vulnerability involves the Linux kernel's KVM SEV-SNP feature where the guest controls the allocation size and entry range for a buffer used in VMGEXIT PSC requests. The kernel fails to validate the end_entry index against the actual buffer size, allowing out-of-bounds access beyond the allocated kmalloc-cg-32 slab objects. This leads to out-of-bounds reads (information leaks) and writes (heap corruption) in host kernel memory. The guest can repeatedly trigger VMGEXITs to manipulate different slab positions, potentially causing use-after-free conditions. The flaw is fixed by enforcing that the scratch area resides in the GHCB shared buffer as per GHCB v2+ specifications.

A malicious SEV-SNP guest can exploit this vulnerability to read adjacent host kernel heap memory, leaking sensitive heap layout information, and write to adjacent heap objects, causing corruption. This undermines the isolation guarantees between guest and host, potentially leading to privilege escalation or denial of service on the host. Use-after-free conditions may also be triggered, increasing instability and risk of further exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description notes it has been resolved by requiring the scratch area to reside in the GHCB shared buffer for GHCB v2+. Until an official fix is confirmed, avoid running untrusted SEV-SNP guests or apply any vendor-provided mitigations. Monitor vendor advisories for updates and patches.