A vulnerability in the Linux kernel IOTLB subsystem permits local attackers to trigger a denial of service condition via uncontrolled memory allocation.

This is a resource management flaw where the vhost IOTLB subsystem fails to properly enforce memory limits for non-retiring tables. An unauthenticated local attacker can exploit this to continue allocating entries beyond defined limits, leading to kernel-level resource exhaustion.

The vulnerability carries a CVSS score of 7.1, indicating a high severity risk primarily due to the potential for complete system instability. A successful exploit results in a denial of service, rendering the affected system or virtualized environment unresponsive. This poses a significant threat to infrastructure reliability, particularly for systems utilizing vDPA or VDUSE drivers, potentially leading to unplanned downtime for business-critical services.

Immediate Action: Update the Linux kernel to version 7.1.9 or later, or apply the upstream fix commits ae128dd19040ee06a4f8143c7ced4d18080d7a9a and 1ed35ac7f3fe2b4396bdd29ac3a7f0ebc0829e94.

Proactive Monitoring: Monitor system logs for kernel panic events or unusual memory consumption patterns associated with vhost-related processes.

Compensating Controls: Restrict local access to the system to authorized users only, as the attack vector requires local presence on the host.

Public Exploit Available: Unknown

Given the potential for system-wide service disruption, administrators should prioritize patching the Linux kernel on all affected hosts. Organizations utilizing virtualized network or storage drivers, such as vDPA or VDUSE, should treat this update with high urgency to prevent potential denial of service attacks that could crash the underlying kernel.