The Linux kernel virtio_console driver fails to release control‑out buffers when a device is removed. During removal, the leftover buffer is passed to free_buf, which treats it as a port_buffer and reads past the ports_device structure, triggering a slab out‑of‑bounds read. This memory corruption can expose internal kernel data or allow an attacker to gain elevated privileges, or it could cause a kernel panic that results in denial of service.

All Linux kernel variants that include the virtio_console driver are potentially affected.

The CVSS score is 5.5 and the EPSS score is < 1%, indicating a moderate risk. The kernel memory corruption could allow an attacker to read or corrupt kernel memory, which may lead to privilege escalation or a kernel panic causing denial of service. No public exploits are known and the CVE is not listed in the CISA KEV catalog. Exploitation would likely require control of a virtual machine or delivery of a payload via the virtio console interface, so the attack vector is limited to privileged or virtualization contexts. Nonetheless, the potential impact on confidentiality, integrity, or availability warrants careful assessment.