The kernel function unregister_virtio_device() performed device removal and released device references that freed the memory holding the virtio_device structure. After the object had been freed, the code still accessed the object’s debugfs_dir field inside virtio_debug_device_exit(), resulting in a use‑after‑free error that allowed arbitrary reads of memory that had just been reclaimed. This type of memory corruption could be leveraged by an attacker to compromise kernel integrity, potentially escalating privileges or enabling other attacks.

The flaw affects Linux kernel versions that include the legacy virtio transports virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo, and virtio_ccw, and that have not yet applied the official patch. These transports are used in various virtualization and hardware emulation scenarios under the Linux kernel. The kernel module configuration must contain the enabled virtio drivers for the vulnerability to be present.

The EPSS score for this issue is not available and the vulnerability is not listed in the CISA KEV catalog, so publicly documented exploitation is not known. However, because the attack requires unbinding a virtio device—which generally requires privileged or local access—a determined local attacker could exploit the use‑after‑free to read kernel memory or corrupt the heap, providing a foothold for privilege escalation. No CVSS score is supplied, but the nature of the flaw suggests significant impact if successfully exploited. The fix removes the debugfs entry before the device is finalized, eliminating the use‑after‑free path.