The’s VFIO PCI driver where the MSI permission table pointer not cleared, leaving a dangling pointer in the device structure. Subsequent openings of the same VFIO device reuse the stale pointer when MSI configuration accesses dereference freed function pointers, and later lead to a double‑free when the device can trigger kernel panics or provide a vector for arbitrary code execution within kernel mode.

All Linux kernel builds that include the VFIO PCI driver are affected, regardless of version identifier in the given CPE. The vulnerability is inherent to the vfio/pci implementation across the Linux kernel source tree.

The EPSS score is < 1% and the CVSS score is not specified, but the failure mode of a kernel panic and the possibility of executing arbitrary code make this a high‑risk flaw. It is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The attack requires local privileged access or the ability to open a VFIO device on the target system, so the likely attack vector is local privileged exploitation. An attacker with sufficient privileges could trigger the bug to compromise kernel integrity or force a reboot.