The vhost IOTLB subsystem permits allocation of map entries beyond the configured limit when the table is not set to retire entries. The add_range function therefore allows non‑retiring tables to continue consuming kernel memory after reaching their maximum capacity. This unchecked growth can exhaust kernel resources, potentially causing a denial‑of‑service, out‑of‑memory failures, or kernel panics. The flaw is specific to the IOTLB allocator and does not provide a direct code‑execution path but can degrade system availability.

All Linux kernel builds that incorporate the vhost IOTLB subsystem are affected, including standard VM and container driver modules. No version range is specified in the advisory, so any release before the official patch is vulnerable.

No CVSS or EPSS score is published for this entry, and it is not listed in CISA KEV. The vulnerability is restricted to contexts that load or interact with vhost IOTLB devices. An attacker with local or privileged access to the kernel runtime that can influence the configuration of a vhost device could trigger the over‑allocation. Remote exploitation would require compromise of the guest or host to manipulate vhost parameters, making the attack surface limited. The primary impact is a potential denial of service via resource exhaustion.