The kernel defect arises when authentication payloads supplied to the request_key() helper are not reference‑counted during revocation or destruction. Because the payload may be freed while still being accessed in the instantiate path, an attacker can trigger a use‑after‑free that corrupts kernel memory. Such corruption could compromise process integrity, provide privilege escalation, or cause a denial‑of‑service by crashing the kernel.

All Linux kernel builds that expose the keyctl subsystem and the request_key() interface are potentially vulnerable. The advisory lists no explicit version range, so any kernel older than the revision that incorporates the fix must be considered affected. Distribution kernels should be checked for inclusion of the patch referenced in the linked Git commit logs.

The CVSS score of 7.8 reflects a moderate‑to‑high severity, while an EPSS score of <1% indicates a very low probability of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog. Because the flaw requires triggering a request_key() operation that involves keyctl with appropriate privileges (CAP_KEY), the likely attack vector is local. Remote exploitation would require an untrusted application that uses keyctl interfaces and is not otherwise restricted.