The bug occurs in the Linux virtio VSOCK receive path where the kernel mistakenly accounts only for unread bytes in the skb accounting function. When a partial packet is received, the counter tracking unread bytes (rx_bytes) is reduced prematurely, causing it to underflow and report a negative byte count to user space. This leads to an empty recv call returning ELOOP and poll indicating a readable socket, effectively stalling communication and allowing an attacker to repeatedly send packets to exhaust resources or lock the VSOCK channel. The flaw does not provide arbitrary code execution but can be used to disrupt normal operation, constituting a denial‑of‑service vulnerability.

The affected product is the Linux kernel virtio transport driver for VSOCK. The vulnerability exists in all kernel releases that include the virtio VSOCK implementation prior to the commit referenced in the advisory. No specific version numbers are provided, so all kernels running an unpatched virtio VSOCK driver are potentially impacted.

The CVSS score is not supplied, and no EPSS score is available, but the flaw is not listed in the CISA KEV catalog. The nature of the bug suggests that an attacker with access to a virtual machine connecting via VSOCK (either locally or remotely if VSOCK is exposed) could exploit it to cause a service interruption. The lack of a current EPSS score indicates uncertain exploitation likelihood, yet the simplicity of the counter underflow means an attacker could trigger the state manually. Administrators should treat this as a medium‑to‑high risk and apply the fix promptly.