In the Linux kernel, the virtio/VSock path contains a use‑after‑free bug that arises when a zero‑copy socket buffer is allocated and then later filled with fragment data. Because the user argument (uarg) is bound too late, a failure to attach all fragment references can cause a rollback that releases an skb lacking the correct uarg, leading the kernel to perform ordinary fragment cleanup on a corrupted buffer. This memory corruption can be exploited by a local attacker with control over virtio packet transmission to overwrite privileged data in kernel memory, potentially gaining higher privileges.

All Linux kernels that have not yet incorporated the commit that injects the user argument before the socket buffer is populated are potentially affected. This includes any distribution running a kernel version prior to the public merge of the fix, such as the 7.1 release candidates listed in the CPE entries.

The CVSS score of 7.8 indicates high severity, while an EPSS score of fewer than 1 % suggests a very low current exploitation probability. The vulnerability is not listed in CISA KEV. Based on the information, the likely attack vector requires local or privileged execution that can trigger the virtio packet transmission path. Consequently, the overall risk is moderate, but the potential for kernel‑memory corruption and privilege escalation warrants prompt action.