This vulnerability exposed a use‑after‑free bug in the Linux kernel’s kthread implementation. When a kernel thread exited via make_task_dead(), the kthread_exit() cleanup path was bypassed, leaving a kthread_affinity node linked to freed memory. Later list operations could overwrite the freed memory, corrupting rcu function pointers. This would likely trigger crashes or, in the worst case, allow execution of arbitrary code if an attacker could force the corrupted function pointer to point to malicious code. The likely attack vector is local kernel code execution or privilege escalation, inferred from the fact that the flaw involves kernel memory corruption and requires code to run in kernel context.

The flaw exists in all publicly released versions of the Linux kernel prior to the patch being merged into the mainline repository. Any distribution whose kernel has not yet incorporated the changes remains vulnerable. The patch modifies behaviour for all kernel threads, regardless of CONFIG_BLK_CGROUP, and is tied to the mainline kernel source tree.

The CVSS score is 7.0. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the bug involves kernel memory corruption, exploiting it would require local code execution or privilege escalation. The patch consolidates exit paths, ensuring cleanup occurs on all exit routes, preventing the bypass that previously allowed dangling list references. Therefore the risk is primarily to systems that have not applied the patch; old kernels may still be vulnerable, requiring mitigation. The conditions for exploitation are not explicitly documented, but the description suggests that an attacker would need to trigger a kthread exit via make_task_dead() while another thread performs a list_del(), which could be arranged through local privilege escalation or compromised kernel code. The vulnerability was addressed in the standard kernel update cycle, and systems that have kept up with kernel updates are no longer affected.