In the Linux kernel, the virtio‑vsock driver allows a worker thread to read a virtqueue that has already been freed and replaced during a device suspend/resume cycle. The worker performs the read before obtaining the queue’s mutex, so the thread can access memory that belongs to the deleted queue. This use‑after‑free can corrupt kernel memory and enable an attacker to hijack control flow, thereby achieving arbitrary code execution with kernel privileges.

All Linux installations that use the virtio‑vsock subsystem and are running kernel versions that do not include commit bd50c5dc182b or later. The vulnerability is present in the subset of kernels where the virtqueue read ordering was left unchanged, affecting any system that attaches virtio sockets to devices scheduled for power‑state transitions.

The CVSS score of 8.4 indicates high severity, while the EPSS score of less than 1 % suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a local attacker capable of inducing device suspend/resume behavior; remote exploitation is unlikely because the flaw requires kernel‑level access. Nonetheless, the potential for local privilege escalation warrants immediate remediation.