The Linux kernel vhost subsystem contains a logic flaw where the function vhost_get_avail_idx reports whether all ring entries have been consumed instead of indicating that new entries have been added. This is a failure to properly verify assignment or comparison, identified as CWE-253. This incorrect return value propagates to vhost_enable_notify and causes the host to repeatedly disable and re‑enable notifications when a guest VM is idle or unable to progress, resulting in a livelock that stalls packet processing for all virtual machines sharing that vhost instance.

Any Linux host running a kernel prior to the inclusion of commit d3bb267b in the vhost/net driver is affected. Systems enabling mergeable buffers for vhost_net are particularly vulnerable, as the flaw is triggered when the driver cannot store an incoming packet in the combined ring entries.

The most likely attack vector is a guest virtual machine communicating over a vhost_net interface or being intentionally idled to trigger the host to immediately disable notifications. The underlying flaw is a CWE-253 misverified comparison. Based on the description, an attacker can manipulate guest traffic or idle the guest to induce the livelock, causing a local denial of service that impacts all VMs on the host. The CVSS score of 7.4 indicates high severity, while an EPSS score of < 1% indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed.