The vulnerability is a use‑after‑free in the Linux kernel’s epoll handling. During a call to ep_remove, the function clears the file->f_ep field and then continues to use the now‑NULL @file within a critical section. A concurrent reference‑count drop frees the file and its associated eventpoll structure while the removal routine still holds a reference, enabling an attacker to trigger a kmem_cache_free on freed memory. The freed memory can then be overwritten with attacker‑controlled data, which may lead to arbitrary kernel writes and privilege escalation. This flaw is identified as CWE‑416 and directly compromises the integrity of the kernel purge path, potentially allowing code execution or system crash.

The flaw affects the Linux kernel itself, irrespective of distribution. All kernel versions compiled from source prior to the application of the patch are potentially vulnerable; the exact release numbers are not listed in the provided data. The issue arises in any build where the epoll subsystem is compiled and used.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw requires a race condition that may be triggered by a local user with the ability to manipulate epoll watches, which is a high‑privilege attack scenario. Because it is a kernel‑level use‑after‑free, successful exploitation can lead to full root takeover or denial of service. The lack of public exploitation data suggests the risk is potentially high for any system that has not applied the patch, but it is constrained to systems that expose the epoll interface and run a vulnerable kernel.