The vulnerability is a use‑after‑free flaw in the Linux kernel’s vsock socket code (CWE‑416). It can cause kernel memory corruption when a socket is unbound after a transport reassignment, potentially allowing an attacker to read or modify memory or execute code with kernel privileges.

The flaw affects all Linux kernel builds that incorporate the vsock module, including Red Hat Enterprise Linux 8, 9, 10 and related derivatives, as well as other distributions using the upstream kernel. No specific version range is listed, so any kernel that has not applied the recent patch may be affected.

The CVSS score of 7.8 indicates a high risk, while an EPSS score of <1 % and absence from the CISA KEV catalog suggest exploitation is unlikely at present. The flaw would likely be triggered by local actions that involve creating or manipulating vsock connections; thus, updating the kernel or limiting vsock usage mitigates the threat.