The flaw exists in the Linux kernel’s futex implementation. When a thread that owns a PI futex exits, the kernel records a reference to the exiting task. Subsequent retry attempts to acquire the same futex mistakenly reuse the stale task pointer because the reference is never nullified. This can trigger a kernel warning and, in the worst case, lead to a crash if the stale pointer is dereferenced. The issue does not directly provide a command‑or‑code‑execution path but can degrade kernel stability. The weakness is classified as CWE‑825, representing a race condition with unsafe use of race‑conditioned state.

This bug affects Linux kernel builds that contain the buggy futex logic. Known affected kernel versions include at least 5.5 and all 7.0 pre‑release candidates (rc1‑rc7). The vulnerability applies to any distribution that ships with a kernel containing that code path until a patch is applied.

The CVSS score of 5.5 reflects a moderate risk, while the EPSS score of less than 1% indicates a very low probability that an attacker would successfully exploit it. The flaw is not listed in CISA’s KEV catalog. Because the bug requires a specific kernel path that is exercised during normal futex usage, it is plausible only with local execution privileges. An attacker with local access could trigger repeated futex contention to provoke the stale pointer warning and potentially destabilize the system, but there is no publicly documented remote exploitation vector.