A use‑after‑free flaw exists in the Linux kernel’s pNFS subsystem. When the pnfs_update_layout function processes a layout request that follows the NFS_LAYOUT_RETURN path, the code calls pnfs_prepare_to_retry_layoutget and may free the layout header before a dependent tracepoint accesses it. The freed memory can be overwritten, and a malicious attacker who can trigger the tracepoint may corrupt kernel memory or execute arbitrary code. Although the flaw is restricted to the NFS layout handling path, an attacker with the ability to craft a specially‑timed layout request could achieve remote code execution on the host running the vulnerable kernel.

The vulnerability affects all linux_kernel installations that contain the unpatched pnfs_update_layout implementation. Both listed vendor identifiers refer to the Linux kernel as a product; no specific release versions are enumerated, so the flaw remains present on any kernel version lacking the upstream commit that moves the tracepoint call before the layout header is freed.

The CVSS score of 9.8 reflects the high impact of a successful exploitation, yet the EPSS score of less than 1 % indicates a low likelihood of this vulnerability being actively abused today. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the most plausible attack vector is a remote NFS client that sends a layout request in a way that triggers the vulnerable tracepoint; success would give the client the ability to execute code in kernel context on the server.