The vulnerability is a use‑after‑free in the ext4 filesystem driver that can occur when an unmount races with a background "update_super_work" job. The faulty race allows the kernel to dereference a freed kobject, potentially corrupting memory and resulting in a crash. Based on the nature of the flaw, it is inferred that an attacker might be able to exploit the use‑after‑free to execute code, but this inference is not confirmed by the advisory. This weakness is identified as CWE-416 and CWE-825.

All Linux kernel deployments that use the ext4 filesystem and have not yet incorporated the fix are affected. No specific version ranges are listed in the advisory, but the issue was addressed in a recent kernel commit, so all older kernel releases prior to that commit remain vulnerable.

The CVSS score of 7.8 indicates a high severity, and the EPSS score is less than 1%, so the likelihood of exploitation is low. The flaw is a kernel‑level use‑after‑free, which grants an attacker the potential for high impact if successfully exploited. The attack vector requires a local race condition between unmounting an ext4 filesystem and the background update job, so remote exploitation is unlikely without additional context. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits as of this analysis.