In the Linux kernel, the function remove_waiter() incorrectly used the current task pointer instead of the waiter task pointer during certain lock paths. This caused synchronization errors in the rbtree, left a dangling pi_blocked_on pointer, and made rt_mutex_adjust_prio_chain() act on the wrong task. The resulting use‑after‑free can lead to kernel memory corruption, crashes, or arbitrary code execution with elevated privileges.

The flaw affects the Linux kernel itself. All builds that contain the unpatched rt_mutex implementation—including mainstream distributions and custom kernels—are vulnerable until the upstream patch is applied. No specific version range is listed; therefore any kernel still running the buggy code is at risk.

No EPSS score is available and the vulnerability is not currently listed in the CISA KEV catalog. The CVSS score is unspecified, but the presence of a use‑after‑free in kernel synchronization logic suggests high severity. Exploitation would require a local attacker with the ability to trigger the faulty futex or proxy‑lock path, which typically involves running code on the impacted system. Because the fault can crash the kernel or be leveraged for privilege escalation, the risk warrants immediate remediation.