A use-after-free vulnerability in the Linux kernel virtiofs subsystem allows local authenticated attackers to achieve high impact on confidentiality, integrity, and availability.

This vulnerability is a use-after-free flaw within the virtiofs filesystem driver, triggered during submount unmount operations when iput() is called from fuse_release_end() after the super block has been destroyed. The attacker requires low local privileges and no user interaction to execute.

Successful exploitation of this kernel vulnerability can lead to complete system instability, kernel panics, or potential arbitrary code execution with high privileges. This poses a severe risk to organizational operations by causing unexpected system downtime and potential compromise of sensitive host data. The CVSS score of 7.8 accurately reflects the high severity of local privilege escalation and system disruption risks.

Immediate Action: Update the Linux kernel to patched versions including 5.10.260, 5.15.211, 6.1.177, 6.6.144, or later versions where synchronous release requests are properly enforced for auto submounts.

Proactive Monitoring: Monitor system logs for kernel Oops messages, kernel panics, or unexpected reboots associated with virtiofs and filesystem unmount events.

Compensating Controls: Restrict local shell access and container mounting capabilities to trusted users only, thereby mitigating the risk of local exploitation.

Public Exploit Available: No

Given the high CVSS score and the potential for severe kernel instability or privilege escalation, IT and security administrators must prioritize updating affected Linux kernel instances. Applying the vendor supplied patches immediately will neutralize the use-after-free condition and secure the virtiofs subsystem against local attack vectors.