The vulnerability stems from a use‑after‑free in the xen‑blkback component of the Linux kernel. When a system reads I/O statistics via sysfs while a frontend block device is being torn down, the statistics data can be freed before the read completes, causing either an UAF or a NULL dereference. Attacking this flaw allows a local user to trigger a kernel fault and, with sufficient conditions, execute arbitrary code with kernel privileges, severely compromising integrity and availability.

The flaw exists in the xen‑blkback module used by Linux kernel implementations that provide Xen paravirtualized block device support. Any distribution running a kernel that includes this module prior to the security fix is affected; the vulnerability applies to all such kernel versions regardless of specific build, as the issue is in the generic xen‑blkback code.

No CVSS score is listed, but the lack of an EPSS rating combined with the local nature of the exploit suggests a high likelihood of impact on systems with local users. The flaw is not in CISA’s KEV catalog, yet because the UAF can lead to code execution at the kernel level, the severity can be considered high. The attack vector is inferred to be local exploitation via the sysfs interface, as the ability to read statistics is available to unprivileged users on many systems. The fix applies a read‑write lock to synchronize access, eliminating the race condition.