The flaw resides in the Linux kernel’s vhost subsystem and occurs when the VIRTIO_F_ACCESS_PLATFORM feature toggles or the IOTLB is refreshed. Cached vring pointers and IOTLB metadata, which are interpreted in a different address space after a transition, are left untouched, allowing stale ring mappings to remain active. An attacker could exploit this by inducing a transition while a worker or descriptor translation is in progress, potentially causing the kernel to read or write to an incorrect memory location, leading to kernel memory corruption, data loss, or denial of service.

This issue affects the Linux kernel via the vhost‑net and vhost‑vsock modules. No specific kernel versions are listed in the data; any running kernel using vhost with the VIRTIO_F_ACCESS_PLATFORM capability is potentially vulnerable until the patch is applied.

The CVSS score is not provided in the source data, and no EPSS value is available, so the measured severity is indeterminate. The likely attack vector is a local or privileged process that can trigger a vhost IOTLB transition, such as a userspace application using the vhost interface. Because the vulnerability manifests through stale internal state rather than an externally exploitable input, the risk is moderate to high for systems that use vhost with address space transition support. The vulnerability is not listed in the KEV catalog, but because it can lead to kernel memory corruption, it warrants timely remediation.