The vulnerability originates in the Linux kernel’s vduse module where vduse_validate_config incorrectly allows vq_align values that are zero or not a power of two to propagate to the vring helper functions. When such an invalid value reaches vring_create_virtqueue_map the alignment mask calculation results in a null used‑ring pointer. A subsequent call to virtqueue_kick_prepare_split dereferences this null pointer, producing a KASAN report and a kernel panic. The effect is a forced system crash and loss of service for the offending virtio device.

This flaw is present in any Linux kernel that contains the unpatched vduse code. The is bundled in later kernel releases, but the exact version numbers are not listed in the provided data. All system installations running a kernel prior to the fix, particularly those that enable virtio-net or other devices using vduse, are susceptible.

The CVSS score of 5.5 indicates moderate severity. The flaw allows a local or potentially privileged attacker to trigger a kernel crash by opening a virtio device with an invalid alignment. No exploitation code or remote code execution is described, but the impact of a denial of service is significant. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, suggesting low current exploitation activity.