In the Linux kernel, the vhost‑vdpa driver permits the configuration callback to read a context pointer without taking a reference or holding a lock. While the callback performs a signal on the context, another thread can swap the pointer and decrement the reference count, freeing the context without a grace period. This race causes the callback to dereference freed memory, leading to a kernel memory corruption, crash, or potentially arbitrary code execution by a local attacker.

The flaw affects any Linux kernel that contains the unpatched vhost‑vdpa driver. Access to the /dev/vduse device is required, which is normally owned by root. A local process with root or equivalent privileges can inject configuration interrupts on VDUSE while another thread swaps the vhost‑vdpa callback, triggering the use‑after‑free. No non‑root escalation path is documented.

No public CVSS or EPSS score is supplied, but the presence of a classic use‑after‑free that corrupts kernel memory indicates a high‑severity issue. Exploitation is limited to concurrent privileged access to /dev/vduse and a vhost‑vdpa device, so it is a local privilege escalation risk. The vulnerability is not listed in CISA KEV, yet it warrants immediate attention because it can allow an attacker to execute code in kernel mode.