A flaw in the Linux kernel’s virtio socket driver allows a worker thread that has been delayed during a power‑state transition (freeze and resume) to read a virtqueue after it has been freed and replaced. This creates a use‑after‑free condition that may corrupt kernel memory or allow an attacker to hijack control flow and execute arbitrary code with kernel privileges. The vulnerability is rooted in the kernel’s handling of the *_run flags during device suspend/resume and the ordering of lock acquisition and virtqueue access.

All Linux systems that use the kernel’s virtio socket (vsock) driver and that run kernel versions containing the vulnerability. The affected code resides in the virtio‑vsock subsystem; the exact affected kernel releases are those that do not include commit bd50c5dc182b or later, which fixes the ordering of mutex acquisition and virtqueue reads.

The vulnerability requires a local attacker who can trigger device suspend/resume behavior on a system with a vulnerable not‑yet‑patched kernel. Because the flaw involves kernel‑level memory corruption, the risk of successful exploitation is high for an attacker with local administrative access. Exploitation is unlikely from remote sources without privilege escalation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently widely exploited. Nonetheless, the potential for local privilege escalation warrants immediate remediation.