The vulnerability arises when the RX worker in the Linux kernel’s virtio vsock module continues to refill the receive queue after the device has been torn down. This race condition allows the kernel to add buffers to a queue that has already been deleted, resulting in a use‑after‑free fault detected by KASAN. The fault can trigger a kernel panic, presenting an attacker with a denial‑of‑service vector that disrupts all processes running on the host.

Affected systems are Linux kernel implementations that include the virtio vsock driver. No specific kernel version range is listed, but the issue exists in any kernel containing the buggy logic before the commit that stops the worker from refilling the queue after removal. Systems running virtualized workloads that use virtio vsock communication are particularly exposed.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that no known public exploits are in circulation yet. However, the flaw can be triggered locally by any process that can cause a virtio vsock device to be torn down while a worker is still scheduled to resume. Because the kernel panic requires kernel execution privileges, the attack is limited to the host or privileged VM. The CVSS severity, if calculated, would be high due to loss of availability, but the overall exploitation probability remains low until an exploit is discovered.