Calling sys_futex_requeue() with mismatched flags in the Linux kernel can trigger a use‑after‑free error, corrupting kernel memory and potentially allowing an attacker to gain arbitrary code execution or escalated privileges. The defect is characterized by CWE‑416.

The vulnerability affects all Linux kernel releases that include the buggy sys_futex_requeue implementation, specifically kernel 6.7 and all 7.0 release candidate stages (rc1 through rc7).

The CVSS score of 7.8 indicates a moderately high severity level, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. Because the vulnerability is not listed in CISA KEV, no widespread exploitation has been observed. The attack vector is likely local: an attacker must invoke sys_futex_requeue() with non‑identical flags, a condition that can be abused to corrupt kernel memory and potentially achieve privilege escalation or denial of service. Applying the patch that enforces identical flags eliminates this risk.