In the Linux kernel, a missing RCU protection guard around the real_parent field in do_task_stat() allows a use‑after‑free condition when /proc/[pid]/stat is read. The bug can cause the kernel to dereference freed task structures, potentially crashing the system or enabling an attacker to execute arbitrary code. The severity of the flaw is high, as it involves kernel memory corruption and could allow privilege escalation or denial of service when a local or privileged user triggers the race.

All Linux kernel releases that have not yet incorporated the patch commits linked above are affected. The vulnerability originates from the core Linux kernel, so any vendor distribution based on those kernel versions is impacted until the fix is applied.

The CVSS score is 7.8, and the EPSS score is < 1%. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a local or low‑privileged process that reads /proc/[pid]/stat, making the risk significant on systems where untrusted user input can target that file. Exploitation would require a race condition that is unlikely without intentional effort, but the potential impact justifies prompt action.