The Linux kernel’s vhost subsystem contains a flaw that occurs when the VIRTIO_F_ACCESS_PLATFORM feature is toggled or the IOTLB is refreshed. Cached vring pointers and IOT interpreted in a different address space after a transition, are left untouched. This allows stale ring mappings to remain active. If an attacker can trigger such a transition while a worker or descriptor translation is in progress, the kernel may read or write to an incorrect memory location, leading to kernel memory corruption, data loss, or denial of service.

This vulnerability affects the Linux kernel via the vhost-net and vhost-vsock modules. Any system running a kernel that supports vhost with the VIRTIO_F_ACCESS_PLATFORM capability—regardless of the exact kernel version unless it incorporates the fix—is potentially vulnerable until the patch is applied.

The CVSS score of 7.0 indicates moderate severity, while the EPSS score of <1% shows a very low probability of exploitation. The vulnerability arises from stale internal state rather than externally supplied input, which limits the attack surface to local or privileged processes that can trigger a vhost IOTLB transition. The description does not explicitly state the attack vector, so the likely attack vector is a userspace application that manipulates the VIRTIO_F_ACCESS_PLATFORM feature to induce an IOTLB refresh while the kernel is handling a descriptor translation. If exploited, the kernel could read or write to an unintended memory location, potentially causing memory. This vulnerability is not listed in the CISA KEV catalog.