In the Linux kernel the virtio_ring implementation can leave stale AVAIL and USED flag bits on descriptors when a packed ring add operation fails. Because these bits remain set, the device may interpret the stale entries as new commands and block the queue, preventing subsequent I/O requests from completing. This flaw is classified as CWE‑459 and can lead to a denial of service in the virtio subsystem for affected processes.

All Linux kernel versions that implement virtio_ring with packed queue support and that have not yet applied the patch in commit 1ce9e6055fa0 are affected. Systems using packed virtqueues, especially under swiotlb configurations with significant memory pressure or large I/O requests, are the ones most likely to experience this issue.

The CVSS score of 5.5, which denotes moderate severity, and the EPSS score of <1% indicate a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog, suggesting no known active exploitation. The typical attack requires a local or kernel‑level privilege to trigger memory pressure or large I/O operations that cause vring_map_one_sg() to fail. If an attacker can repeatedly induce such failures, they could cause the virtqueue to stall and deny service to the affected processes.