The kvm_emulate_hypercall function in arch/x86/kvm/x86.c in KVM in the Linux kernel 2.6.25-rc1 and other versions before 2.6.31 when running on x86 systems does not prevent access to MMU hypercalls from ring 0 which allows local guest OS users to cause a denial of service (guest kernel crash) and read or write guest kernel memory via unspecified \random addresses.\