The vulnerability arises from a device mismatch between virtio_device and net_device during allocation and deallocation in the virtio_net driver, causing devres warnings. This improper free can corrupt kernel memory and may lead to a panic or other instability, representing a significant reliability and availability risk for affected systems.

All Linux kernel versions that include the virtio_net driver before the patch fixing this mismatch are affected. The flaw is present in kernels such as 6.18.0 and any kernel where the virtio_net driver allocates the RSS header with virtio_device->device but frees it via net_device->device. The issue was observed when modules like vdpa, virtio_vdpa, and octep_vdpa are loaded on the system.

Based on the description, the likely attack vector is the loading or unloading of vulnerable kernel modules that trigger the mismatched free during virtio_net allocation and deallocation. The CVSS score of 7.0 marks this defect as high severity, while the EPSS score of less than 1% indicates that exploitation is currently unlikely. It is not listed in CISA’s KEV catalog. Exploiting the mismatched free could corrupt kernel memory, potentially leading to a crash or denial of service.