This vulnerability occurs during grant-copy operations when the grant resource is already in use (pinned) by another operation such as a mapping or another copy. The referenced guest frame is looked up for permission checks and copying, but if the grant is concurrently active, the permission check may be performed on a different page than the one actually copied. This inconsistency can cause incorrect permission enforcement, potentially allowing unauthorized access or modification of memory pages. The vulnerability is classified under CWE-367 (Time-of-check Time-of-use (TOCTOU) race condition) and has a CVSS 3.1 vector indicating local attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

The vulnerability can lead to unauthorized disclosure, modification, or denial of service due to inconsistent permission checks during grant-copy operations. Because the permission check may not correspond to the actual memory page copied, attackers with local access and low privileges could exploit this to escalate privileges or corrupt memory, impacting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict local access to trusted users and monitor for suspicious activity related to grant-copy operations if possible.