The issue originates in the Linux kernel's vfio_pci driver. A reordering of error handling removed the necessary VGA arbiter unwind step when register_device() fails. This oversight can leave a dangling reference to a freed virtual device cookie. When callbacks later reference this stale object, a use‑after‑free occurs, corrupting kernel memory. The flaw leads to kernel memory corruption.

Any Linux kernel that runs the vfio_pci driver without the patch that re‑introduces the VGA unwind logic is affected. The affected component is the vfio_pci driver; specific kernel versions are not listed, but any release prior to inclusion of the commit that restores the unwind may be vulnerable.

The CVSS score of 8.8 indicates a high severity level for this kernel memory corruption flaw. The EPSS probability is below 1 % and the vulnerability is not listed in CISA KEV, indicating a low current exploitation likelihood. However, the nature of the flaw—kernel memory corruption—yields high severity if an attacker can trigger the failure path locally. The attack vector is inferred to be a local user or process with access to VFIO devices, as no remote exploitation method is documented. Given the limited exploitability but significant impact, administrative vigilance is warranted.