In the Linux kernel’s keyring subsystem an associative‑array lookup performed in find_key_to_update() is executed without holding the required RCU read lock. The garbage‑collection routine later frees the node after an RCU grace period. This mismatch allows a lookup thread to read memory that has already been freed, creating a use‑after‑free condition. The flaw is limited to dynamic or persistent key handling, which uses a distinct locking model, so it would only affect keyring operations that rely on that path. An attacker who can trigger lookups while the node is being freed could corrupt kernel memory and cause a crash or, potentially, elevate privileges if the corruption can be controlled.

Affected systems are all Linux kernel builds that contain the keyring module. The included CPE list focuses on the 7.1 release candidates, ranging from rc1 to rc5, but the issue is generic enough to impact any kernel version that compiles the keyring code without the fix. Administrators should check their kernel version and verify whether the missing RCU guard exists in the source.

The CVSS base score of 7.8 classifies the flaw as high severity, yet the EPSS score indicates that automated exploitation attempts are currently very unlikely. The vulnerability requires the attacker to perform a key lookup concurrently with a node being freed, which generally demands local or privileged execution. The flaw is not currently listed in the CISA KEV catalog, and no public exploit has been reported. Based on the information supplied, mitigations should prioritize applying the upstream patch before attempting any temporary workarounds.