A flaw in the Linux kernel’s virtio_vsock implementation causes the send routine to bind a user argument (uarg) to a socket buffer (skb) after the buffer has already been filled for zero‑copy transmission. When the number of fragments reaches a kernel‑defined maximum, a partial attachment of managed fragments can return an error and the rollback path frees an skb that still contains fragment references but lacks its uarg. The subsequent release routine falls through to ordinary fragment cleanup, creating an use‑after‑free situation that may corrupt kernel memory and allow a local attacker to gain privilege escalation.

The kernel code path is part of the generic Linux kernel; any distribution that has not incorporated the patch commit that binds the uarg before filling the skb is potentially affected. This includes all systems running a kernel version prior to the public merge of the fix referenced in the kernel‑git URLs provided.

The CVSS score of 7.8 indicates a high severity, while an EPSS below 1 % reflects a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, and the required conditions—local control of virtio packet transmission—suggest that only local or privileged users can trigger it. Consequently, the overall risk is moderate, but the lack of immediate exploit evidence does not diminish the importance of applying the fix promptly.