The vulnerability in the Linux kernel's KVM SEV feature concerns the handling of CPUID data for Secure Nested Paging (SNP) guests. When initializing a guest_memfd instance with CPUID data, KVM writes back corrected CPUID information if the userspace data is rejected by trusted firmware. The flaw was that the source page was pinned for read access only, but KVM performs writes via a kernel mapping. This mismatch could lead to KVM writing to read-only memory, causing potential memory corruption. The fix involves acquiring a writable pin on the source page to safely allow these writes. Since CPUID data is usually dynamically generated by userspace and not read-only, typical VMMs are unlikely to encounter this issue.

The impact is limited to potential memory corruption in the kernel when KVM writes back CPUID data to a read-only pinned source page. This could affect the stability or security of the host kernel running KVM with SEV SNP guests. However, well-behaved VMMs that dynamically generate CPUID data and do not use read-only mappings are unlikely to be affected. No exploitation in the wild has been reported.

A fix has been implemented in the Linux kernel to acquire a writable pin on the source page when adding CPUID data for SNP guests, preventing writes to read-only memory. Users should update to a kernel version that includes this fix. Since this is a kernel-level fix, no additional mitigations are required beyond applying the official patch when available. Patch status is not explicitly stated; check the vendor or Linux kernel stable release notes for the exact fixed versions.