A double‑free occurs in the Linux kernel’s virtio‑fs driver when virtio_find_vqs() fails during device initialization. The error path frees fs->vqs and fs->mq_map, and then the normal kobject release frees them again, leaving dangling pointers that can corrupt kernel memory or crash the system.

Linux kernel installations that enable virtio‑fs and have not yet incorporated the commit that clears the pointers after freeing are vulnerable. It is inferred that any kernel version lacking this patch, or any system that loads the virtio‑fs module without the fix, falls into this group.

The CVSS score of 8.4 indicates a high‑severity flaw, and the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. Based on the description, it is inferred that an attacker would need local or privileged control over the virtual machine configuration to manipulate the virtio‑fs device’s advertised queue count, implying local or privileged access. Remote exploitation is unlikely without such access.