The vulnerability resides in the virtio_input driver of the Linux kernel. During removal of a virtio input device the driver calls input_unregister_device before the underlying virtio device is reset. Because virtinput_recv_events clears the ready flag after dropping the lock around input_event, callbacks that started before removal can still access the freed input device handle, requeue buffers, and trigger the queue. This race condition results in a use‑after‑free that can corrupt kernel memory, cause a panic, or cause other disruptive effects.

The flaw affects any Linux kernel release that contains the buggy virtio_input implementation prior to the fix committed in the referenced patches (5378f7945856, 8226aeee9b9a, a3ba86a270dd, d7808b37da0). Systems running a virtual machine that relies on virtio input devices—such as many cloud or virtualization environments—are at risk. The fix is included in kernel versions following those commits; upgrading to a patched kernel removes the vulnerability.

The CVSS score of 7.0 indicates high severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation to date. Based on the description, it is inferred that the attack appears to require local or near‑local access to trigger virtio input events during device removal, making it a high‑severity denial‑of‑service risk if an attacker can control the device or its removal. In environments where privileged users can force module unloading or hot‑unplug devices, the risk is higher; otherwise the likelihood of exploitation remains low.