When the Linux kernel probes the hv:vmbus driver, the bus match function is called without holding the device lock. This allows the code to read the driver_override field concurrently, which can result in a use‑after‑free if another thread frees or modifies the driver structure. The resulting memory corruption could enable an attacker to corrupt kernel data or execute arbitrary code in kernel mode.

All Linux kernel builds that contain the hv:vmbus driver are affected. No specific kernel releases are listed, so any distribution running an unpatched kernel requires review.

Exploitation requires access to a running kernel and the ability to trigger a driver probe, which is typically achievable with local privilege or by running privileged code. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, but the vulnerability type (use‑after‑free) is a high‑severity flaw that could allow local privilege escalation to kernel level. The likely attack path involves loading or reloading the hv:vmbus driver while the device lock is not held, leading to the race condition described.