The Linux kernel’s vhost/vdpa driver uses the offset supplied in an mmap or fault operation as an index into its virtqueue array without fully validating that the index lies within the supported range. The code performs only a 16‑bit check, allowing a crafted offset that corresponds to an out‑of‑range index to pass into the driver’s get_vq_notification callback. As a result, the callback may read or write beyond the bounds of its data structures, leading to an invalid page frame number remap and a kernel crash or denial‑of‑service. This is a classic array‑index misuse identified by CWE-787. Based on the description, it is inferred that the vulnerability arises when a process maps or accesses vhost/vdpa device memory with a specifically chosen offset that forces the driver to treat the value as a virtqueue number that does not exist. The insufficient bounds check allows the index to be used in the callback context. The main impact is that a local or remote user that can interact with the vhost/vdpa interface can trigger unstable kernel behavior, potentially compromising system availability without breaching confidentiality or integrity beyond the immediate crash.

The affected product is the Linux kernel and its vhost/vdpa subsystem. While no specific kernel versions are listed, the flaw exists in any kernel that includes the vhost/vdpa driver before the commit that added the unified bounds check. All distributions shipping such a kernel with the vhost/vdpa module are potentially impacted.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. However, based on the description, the likely attack vector is a process with permission to open a vhost/vdpa device and supply a crafted mmap offset or fault trigger. If such a process gains root or sufficient privileges, an attacker could trigger a kernel panic and deny service to the system. The risk remains significant enough to warrant patching.