A critical use-after-free and memory corruption flaw in the Linux kernel vhost framework could allow a local attacker to achieve arbitrary code execution.

The vulnerability is caused by a failure to reset the vring metadata cache during vring reconfiguration. An authenticated local attacker can trigger this issue by issuing specific ioctl calls, such as VHOST_SET_VRING_ADDR, which causes the kernel to use stale memory mappings and perform out-of-bounds memory accesses.

The vulnerability carries a CVSS score of 8.8, reflecting its high severity. Successful exploitation permits a local attacker to escalate privileges, corrupt kernel memory, or trigger a system crash, resulting in significant service disruption and potential compromise of sensitive data processed within the virtualized environment.

Immediate Action: Apply the vendor-provided kernel updates to version 5.10.265, 5.15.216, 6.1.183, 6.6.152, or newer.

Proactive Monitoring: Monitor system logs for repeated segmentation faults or kernel oops messages associated with vhost-related processes.

Compensating Controls: Restrict access to virtualization management interfaces and ioctl-based operations to only highly privileged, trusted users to limit the attack surface.

Public Exploit Available: Unknown

Given the potential for kernel-level memory corruption and arbitrary code execution, this vulnerability poses a severe risk to infrastructure integrity. Administrators should prioritize patching affected kernels as part of the next scheduled maintenance cycle or sooner if the environment supports untrusted local users.