The vulnerability in the Linux kernel KVM x86 virtualization arises from the optimization of the handle_tpr_below_threshold() function, where apic_update_ppr() replaced raising KVM_REQ_EVENT. If no new interrupts are pending, apic_update_ppr() does not raise KVM_REQ_EVENT, causing kvm_lapic_update_cr8_intercept() and vmx_update_cr8_intercept() not to be called before VM entry. This results in a stale TPR_THRESHOLD value, violating VMX execution control checks and causing VM entry failures with hardware error 0x7 on systems lacking APICv support or under nested virtualization on hypervisors like Hyper-V. The remediation involves calling kvm_lapic_update_cr8_intercept() when apic_update_ppr() does not find deliverable interrupts, ensuring proper CR8 intercept updates on all PPR update paths.

This vulnerability can cause virtual machine entry failures with hardware error 0x7 on affected systems, particularly older hardware without APICv support or nested virtualization environments on hypervisors that enforce strict VMX execution control checks. This may lead to denial of service for virtual machines relying on KVM on such platforms. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates that a code fix has been implemented in the Linux kernel to address this issue by ensuring CR8 intercepts are updated correctly on all PPR update paths. Users should monitor official Linux kernel advisories and update to fixed kernel versions once available. No alternative mitigations are specified.