The vulnerability arises during the VFIO device unregistration routine when debugfs entries referencing a devres-allocated structure are removed after the structure has already been freed. This creates a use‑after‑free scenario where the debugfs inode still holds stale private data that may be accessed by user space. The impact is potential kernel instability, including crashes or memory corruption, which could disrupt system operation.

The defect is present in all Linux kernel versions that have not applied the vfio: Remove device debugfs before releasing devres patch. It affects the VFIO subsystem across generic distributions and any custom kernels lacking the change. Devices that expose VFIO debugfs entries during unregistration are at risk.

The EPSS score indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need privileged access to manipulate VFIO devices and be able to trigger device unregistration while the debugfs entries persist; this scenario suggests exploitation is possible but requires elevated privileges and timing, making it a local, but potentially high‑impact risk.