16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems

A use-after-free vulnerability lurking in Linux's KVM hypervisor for 16 years demonstrates how long-lived kernel flaws can remain undetected while posing catastrophic risk to virtualized infrastructure. The flaw allows a privileged guest VM to corrupt host kernel memory and potentially achieve full host code execution, breaking the fundamental isolation boundary that virtualization security relies upon. This is especially dangerous in multi-tenant cloud and shared hosting environments where guest root access may be attainable by untrusted parties. The vulnerability highlights the compounding risk of legacy codebases, where security debt accumulates silently until a researcher or adversary discovers it — by which point exploitation capability may already exist outside of public disclosure.