The vulnerability is a use‑after‑free in the ext4 filesystem driver that can occur when an unmount races with a background "update_super_work" job. The faulty race allows the kernel to dereference a freed kobject, potentially corrupting memory and resulting in a crash or, in the worst case, an elevation of privilege or arbitrary code execution within the kernel. This weakness is identified as CWE‑416.

All Linux kernel deployments that use the ext4 filesystem and have not yet incorporated the fix are affected. No specific version ranges are listed in the advisory, but the issue was addressed in a recent kernel commit, so all older kernel releases prior to that commit remain vulnerable.

The CVSS score is not provided, and the EPSS score is unavailable, so the likelihood of exploitation cannot be quantified from the available data. The flaw is a kernel‑level use‑after‑free, which grants an attacker the potential for high impact if successfully exploited. The attack vector requires a local race condition between unmounting an ext4 filesystem and the background update job, so remote exploitation is unlikely without additional context. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits as of this analysis.