In the Linux kernel, the vsock subsystem contains a bug where the buffer size clamping logic checks the minimum size before the maximum size. When a user specifies a minimum larger than the configured maximum, the minimum check overrides the maximum, allowing the socket buffer to grow beyond the intended limits. This can cause the socket memory to exceed its intended boundary, potentially exhausting system memory or triggering undefined behavior. The vulnerability grants a denial‑of‑service condition on the host system.

All Linux kernels that include the vsock implementation prior to the commit that applies the corrected clamping logic are affected. The Common Platform Enumeration string indicates all variants of the Linux kernel, and no specific version numbers are enumerated in the advisory; any release that predates the fix is potentially vulnerable.

The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.8 classifies it as high severity. The exploit route requires control over the vsock buffer size settings, implying a local or privileged user context; however the impact of exceeding the buffer size could affect system stability. In the absence of a public exploit, the risk is primarily theoretical until demonstrated; administrators should consider the potential for denial of service in environments that rely on versus sockets.