The Linux kernel’s inode_switch_wbs_work_fn() contains a loop that can run after its referenced writeback structure has already been freed. This creates a use‑after‑free condition (CWE‑416). Based on the nature of such a flaw, it is inferred that a local attacker could corrupt kernel memory, potentially leading to privilege escalation or arbitrary code execution within kernel mode, although the specific exploitation path is not detailed in the input.

All Linux kernel versions preceding the commit that removes the problematic loop are affected. The known affected CPEs include the main Linux kernel and the 7.1 release candidates (rc1 and rc2). No specific fixed version numbers are listed in the input, so any kernel build that does not incorporate the referenced commit is vulnerable.

The CVSS score of 7.8 indicates high severity. The EPSS score is listed as < 1 %, signifying a very low but non‑zero exploitation probability. The vulnerability is not included in the CISA KEV catalog. The likely attack vector is local, given that the flaw resides in kernel internals and would require an attacker with the ability to trigger the writeback subsystem. Exploitation would yield kernel‑level compromise if successful, thus the overall risk to affected hosts remains significant until patched.