The flaw is in the Linux kernel’s io_wq_remove_pending routine, where the code fails to validate that a predecessor work item is hashed before reusing hash_tail pointers. When a hashed work entry is cancelled while an un-hashed predecessor is present, a stale pointer to freed memory is stored in wq->hash_tail[0]. Because the fast path for non-hashed work never clears this pointer, it becomes a dangling reference that may later be dereferenced by io_wq_insert_work, leading to kernel memory corruption. The likely attack vector is a local process that can orchestrate the specific sequence of IO cancellations and enqueues required to trigger the dangling pointer logic, potentially causing a denial of service or kernel fault. The weakness maps to CWE-416: Use-After-Free.

All Linux kernel installations that predate the patch commit 252c5051 are potentially affected. This includes mainstream distributions running kernel 5.15.x, 6.1.x, 6.2.x and earlier releases, where the io_wq subsystem remains unpatched.

The CVSS score is unavailable and EPSS data is not provided, but kernel use-after-free defects typically carry high severity due to the possibility of memory corruption. No public exploits are listed in CISA KEV, and no known active exploits have been reported. However, an attacker with local access that can influence IO scheduling could exploit the defect to crash the system or, in some scenarios, elevate privileges.