This bug occurs in the Linux kernel's eventpoll implementation. When a thread calls ep_free() to release an eventpoll object, the kernel code can free the underlying struct eventpoll even while another concurrent thread still holds a reference to it. This race condition results in a use‑after‑free scenario that could allow a malicious actor with sufficient privileges to manipulate memory after the kernel has released it, potentially leading to arbitrary code execution or kernel data corruption.

The vulnerability affects the Linux kernel, as identified by the CNA vendor name Linux:Linux. The exact kernel releases impacted by this defect are not listed, and an explicit version range is currently unavailable.

The flaw is a privileged kernel use‑after‑free, a highly severe weakness. The CVSS score is 7.8 and the EPSS score is < 1%, but a bug of this nature generally warrants high risk. Because the affected code operates at ring‑zero, exploitation requires a local or privileged context that can induce a race condition in eventpoll. While no exploit is publicly known, the vulnerability is serious enough that the CISA KEV catalog does not list it as of now, suggesting the risk is low to moderate but the potential impact is catastrophic if leveraged. The likely attack vector is local privilege escalation, where a privileged user or compromised application triggers the race condition via eventpoll or epoll interfaces.