A double‑free occurs in the Linux kernel’s virtio‑fs driver when virtio_find_vqs() fails during device initialization. The error path frees fs->vqs and fs->mq_map, and then the normal kobject release frees them again, leaving dangling pointers that can corrupt kernel memory or crash the system.

Linux kernel installations that enable virtio‑fs and have not yet incorporated the commit that clears the pointers after freeing are vulnerable. It is inferred that any kernel version lacking this patch, or any system that loads the virtio‑fs module without the fix, falls into this group.

The CVSS score of 8.4 indicates a high‑severity flaw, but the EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting limited exploitation records. Based on the description, it is inferred that an attacker would need the ability to manipulate the virtio‑fs device’s advertised queue count, implying local or privileged control over the virtual machine configuration. Remote exploitation is unlikely without such access.