The vulnerability occurs in the fuse subsystem of the Linux kernel when fuse_try_move_folio() unlocks a request on entry but fails to re-lock it on the success path. This oversight can allow fuse_chan_abort() to end the request and free fuse_io_args while subsequent copy-chain logic still accesses them, resulting in a use‑after‑free condition. Based on the description, it is inferred that an attacker could exploit this race condition to corrupt kernel memory or execute arbitrary code with the privileges of the process generating the request. This issue is classified as CWE‑825, which corresponds to a use‑after‑free scenario involving dereferencing freed memory.

All Linux kernel installations that include the fuse component are potentially affected, as the flaw exists in the core fuse source and applies to any variant of the kernel where fuse is compiled in. No specific kernel releases are identified in the advisory, so any version prior to the patch could be vulnerable.

The CVSS score of 7.8 denotes high severity, yet the EPSS score is below 1%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. Based on the description, it is inferred that the attack vector is probably local, as the flaw involves interaction with fuse page-cache management. Remote exploitation would require prior compromise or privileged access. Systems that expose fuse filesystems to other users may increase risk.