Local privilege escalation via racy MMIO emulation

Privilege escalation in the Linux kernel before 6.5.9 allows local users in SEV-ES guests to gain root access via MMIO emulation. The #VC handler decodes a userspace instruction after validating its MMIO access, so a racing process can replace the instruction and redirect emulated reads or writes into kernel memory. Exploitation requires a confidential AMD SEV-ES or SEV-SNP guest, low-privileged local code, and cooperation from its untrusted hypervisor; arbitrary kernel read and write access enables root privilege.