The Linux kernel's KVM nested virtualization (nSVM) subsystem had a flaw where unhandled VMMCALL instructions were not properly raising a #UD exception when L2 was active and L1 did not intercept the call, with nested_svm_l2_tlb_flush_enabled() true and the hypercall not among supported Hyper-V hypercalls. Instead of forwarding the hypercall to L1 or raising #UD, KVM intercepted it but allowed L2 to make hypercalls as if it were L1, violating architectural behavior. This could lead to unintended hypercall execution by L2. The issue was addressed by explicitly synthesizing a #UD exception in these cases. The fix is included in Linux kernel updates, with numerous affected versions identified and fixed in kernel 7.0.0 and later. The vulnerability has a CVSS 3.1 score of 7.9 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H).

This vulnerability allows a local attacker with limited privileges to potentially execute hypercalls at the L2 level as if they were L1, which could lead to privilege escalation or compromise of nested virtual machine isolation. The CVSS score of 7.9 indicates a high severity impact with potential confidentiality, integrity, and availability impacts. However, exploitation requires local access and conditions involving nested virtualization. No known exploits in the wild have been reported.

A patch is available and included in Linux kernel updates starting with version 7.0.0-27.27 and related builds. Users should update their Linux kernel to the fixed versions and reboot their systems to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow vendor guidance for updating and rebuilding kernel modules as needed.