The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts
that use qemu userspace without XSAVE, allows local users to cause a denial
of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the
X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN
ioctl.

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual
machine) subsystem's handling of the XSAVE feature. On hosts, using qemu
userspace, without the XSAVE feature an unprivileged local attacker could
exploit this flaw to crash the system.