In the Linux kernel, the vhost‑vdpa driver allows a configuration callback to read a context pointer without taking a reference or holding a lock. While the callback performs a signal on the context, another thread can swap the pointer and decrement the reference count, freeing the context immediately. This race causes the callback to dereference freed memory, leading to kernel memory corruption, a crash, or potentially arbitrary code execution by a local attacker.

The flaw affects any Linux kernel that contains the unpatched vhost‑vdpa driver. Access to the /dev/vduse device is required, which is normally owned by root. A local process with root or equivalent privileges can inject configuration interrupts on VDUSE while another thread swaps the vhost‑vdpa callback, triggering the use‑after‑free. No non‑root escalation path is documented.

The CVSS score is 5.5, indicating moderate severity, and the EPSS score is less than 1%, so the likelihood of exploitation is low. However, because the vulnerability leads to use‑after‑free kernel memory corruption, it is a serious security risk. Exploitation requires concurrent privileged access to /dev/vduse and a vhost‑vdpa device, so it is limited to a local privilege escalation scenario. The vulnerability is not listed in the CISA KEV catalog.