A use‑after‑free condition exists in the Linux kernel block‑cgroup work‑queue release path. When the CSS reference is released by css_put() before the blkcg_unpin_online() function accesses the blkcg structure, the blkcg object can be freed asynchronously, leading to a dereference of a stale pointer. The resulting memory corruption can manifest as a kernel panic or other unstable behavior. This weakness corresponds to CWE‑366 (Race Condition) and CWE‑416 (Use After Free).

The bug is present in any Linux kernel image that has not been updated to include the change in commit 66672af7, which moves the blkcg_unpin_online() call before css_put(). All distributions shipping an unpatched kernel are potentially affected, regardless of vendor, as the flaw resides in the upstream kernel source. The patch is incorporated in the next‑generation kernel series.

The CVSS score of 7.8 reflects the potential for significant kernel compromise, while the EPSS score of <1% indicates that exploitation is presently considered unlikely. The vulnerability has not been cataloged by CISA’s KEV. The attack vector is not explicitly documented; based on the description, the likely attack vector involves manipulating block I/O operations or scheduling of work queues to induce the race window. The narrow timing requirement means that an adversary would need to precisely orchestrate the sequence of events, and no remote exploitation has been reported.