The vulnerability occurs in the Linux kernel’s KVM/x86 module when an IRQ routing entry fails to update. The code leaves a dangling pointer in the irqfd structure, specifically the producer reference, which can later be dereferenced after the producer has been freed. This use‑after‑free can corrupt kernel memory and potentially allow an attacker to execute arbitrary code or elevate privileges within the kernel.

The affected system is the Linux kernel with KVM support on x86. No specific version range is listed, so any kernel build that contains the upstream KVM code before the inclusion of the upstream fix is potentially vulnerable. All distributions shipping such kernels should review their current versions.

The CVSS score is 8.8 and the EPSS score is < 1%, indicating a severe weakness with a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a virtual machine or local user that can influence IRQ routing or manage VFIO PCI devices, based on the description. Exploitation would require triggering the failure path during a routing update, after which the dangling pointer could be dereferenced. Because no public exploitation details exist and the path involves kernel routing logic, practical exploitation may be limited to environments with advanced virtualization control. The risk remains severe due to the use‑after‑free nature, but the exact likelihood of exploitation is uncertain.