A use‑after‑free condition exists in the io_uring/zcrx subsystem of the Linux kernel. The flaw arises when io_free_rbuf_ring releases a struct user_struct that has already been freed by io_zcrx_ifq_free, allowing an attacker to use the stale reference. Such a flaw can lead to arbitrary code execution or corruption of kernel memory, potentially giving an attacker elevated privileges on the affected system.

All Linux kernel implementations that include the io_uring/zcrx feature are impacted. The vulnerability applies to any distribution that ships the vulnerable kernel; specific affected versions are not listed in the advisory, so all kernel releases prior to the patch commit should be considered at risk.

The CVSS score is not provided, and the EPSS score is not available, so the exact likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog. Based on the type of flaw, a malicious local attacker able to trigger the double free could potentially gain root level privileges or destabilize the system. The attack vector is likely local, requiring interaction with the io_uring subsystem or a specially crafted payload that causes the double free to occur.