The race between dquot_release_workfn and dquot_scan_active allows a user to trigger a use‑after‑free of a dquot object. When a dquot is released while another thread scans active quots, the freed object can be accessed under memory pressure, leading to memory corruption that can crash the kernel or potentially be leveraged for privilege escalation. This weakness is a race condition (CWE‑362) that results in a use‑after‑free (CWE‑617).

The flaw exists in the Linux kernel's quota subsystem. All kernel builds that include the quota implementation and expose a quota_release_workfn path are affected, including mainstream distribution kernels running community editions of Linux. No specific version list is given, so any kernel prior to the patch commit is impacted.

The lack of an EPSS score or KEV listing indicates that public exploitation has not been documented. Nonetheless, the flaw permits local memory corruption and could be exploited by a user with sufficient permissions. Attackers would normally need to trigger a quota deactivation while another thread is scanning active quots, which may require user‑level interaction. Because the bug is not exposed to unprivileged users through the network, the practical attack surface is moderate, but the potential for privilege escalation remains high.