The kvm_emulate_hypercall function in arch/x86/kvm/x86.c in KVM in
the Linux kernel 2.6.25-rc1, and other versions before 2.6.31, when
running on x86 systems, does not prevent access to MMU hypercalls
from ring 0, which allows local guest OS users to cause a denial of
service (guest kernel crash) and read guest kernel memory via
unspecified "random addresses."