The vulnerability occurs in the Linux kernel's QRTR subsystem when qrtr_port_remove() decrements the socket reference count before removing the port from the XArray and before an RCU grace period. This violates the RCU update paradigm and creates a race where an RCU reader can obtain a pointer to a socket whose reference count has already dropped to zero. The race was observed during fuzz testing, causing refcount saturation warnings and a potential Use‑After‑Free. The flaw allows an attacker to corrupt memory or gain unauthorized access, potentially escalating privileges.

All Linux kernels that include the QRTR module cover current mainline releases and downstream distributions that ship the same kernel code. No specific version delimitations were listed, so any deployment using the qrtr driver is potentially impacted until the patch is applied.

The CVSS score is not provided, and the EPSS is unavailable, so quantifying likelihood is difficult, but a UAF of this nature is considered high severity. The flaw is not listed in CISA KEV, so current exploitation activity is unknown. If an attacker can trigger the race—likely requiring local or elevated privilege—the impact would be local privilege escalation or denial of service. The lack of a public exploit is reassuring, but the potential remains significant.