CVE-2021-22543: Improper memory handling in Linux KVM

Security readout for executives and security teams

CVE-2021-22543 is a Linux KVM flaw that can let a local user who can create and control a virtual machine access memory they should not. On affected virtualization hosts, this can become local privilege escalation and could affect host or guest memory confidentiality and integrity. Exposure is most relevant to Linux systems running KVM where non-administrative or semi-trusted users can access /dev/kvm or launch VMs. Multi-tenant virtualization, developer workstations, CI runners, and managed appliances using affected kernels deserve review. Non-KVM systems are less likely to be exposed. Treat this as high priority for virtualization hosts with shared or delegated VM access. The business risk is local privilege escalation and memory compromise on affected KVM systems, but the current evidence does not support claiming active exploitation. Mitigation focus: Apply kernel updates from the relevant Linux distribution or vendor advisory.; Prioritize KVM hosts where untrusted users can create or control virtual machines.; Restrict /dev/kvm access to trusted administrators until fixed..

Prepared

May 23, 2026, 08:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.