The defect is in the vsock/vmci transport layer of the Linux kernel. A reset packet issued during the TCP-like handshake is incorrectly treated as a normal error, which causes the system to retain a reference to a pending socket. When a scheduled work queue later runs, it accesses the socket after it has already been freed, resulting in a use-After-Free kernel memory corruption that could be exploited for arbitrary code execution.

Any installation of the Linux kernel that has not yet incorporated the recent vsock/vmci fix is affected. The patch was merged into mainline and is available in the 6.12 LTS series starting at 6.12.79, so all kernel releases prior to that or earlier mainstream releases remain vulnerable unless a later revision is applied.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local or virtual machine that can send a reset packet on a vsock connection; this inference is drawn from the nature of the bug, as it requires interaction with the vsock/vmci transport layer. Exploitation would involve flooding the socket with a reset during the handshake to trigger the use-After-Free, potentially allowing privilege escalation to root or system compromise if kernel memory is corrupted.