In kernel vhost-net, the completion routine treats every ubuf callback as a finished descriptor, decrementing the ubuf reference count even when only a cloned skb reference is released. A backend reset can free the shared ubuf_info while a cloned skb still references it, causing a stale dereference that triggers a use‑after‑free in vhost_zerocopy_complete. The vulnerability is a memory misuse classified as CWE‑825. Based on the description, this memory corruption could lead to a kernel panic or enable an attacker to execute code with kernel privileges. The impact is confined to kernel memory, allowing compromise of confidentiality, integrity, and availability of the affected system.

Based on the description, it is inferred that all Linux kernel builds that include the vhost‑net zero‑copy backend are potentially affected. The advisory does not list specific kernel versions, so any kernel incorporating the vulnerable vhost‑net implementation prior to the fix is at risk.

The CVSS score of the vulnerability is 9.3, indicating a critical severity. The EPSS score is < 1%, showing a very low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a virtualized environment that employs the vhost‑net zero‑copy path; a virtual machine or container communicating through a vhost interface could trigger the flaw when a backend reset occurs while a cloned skb is still pending. The required conditions include the presence of the vulnerable kernel, usage of zero‑copy networking, and a scenario where skb cloning such as batman‑adv fragmentation happens. Successful exploitation could lead to a kernel memory corruption that may result in a system crash or privilege escalation with kernel‑level access.