In the Linux kernel’s keyring subsystem, an associative array lookup in find_key_to_update() does not acquire the required RCU read lock while the garbage‑collection code frees nodes after an RCU grace period. This mismatch can cause a lookup thread to traverse memory that has been freed, leading to a use‑after‑free condition. The vulnerability is specific to persistent key handling, which uses a different locking model than regular key operations. The description suggests that a successful exploit could corrupt kernel memory, though this effect is inferred from the use‑after‑free nature of the flaw.

All Linux kernel builds that include the keyring subsystem are potentially affected until the missing RCU read block is applied. No specific version range is provided, so any unpatched kernel with keyring support enabled is at risk.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% points to a low probability of widespread automated exploitation. The flaw requires the attacker to trigger a key lookup while a node is concurrently being freed, which typically demands local or privileged access. If successfully exploited, it could lead to a denial‑of‑service or, as inferred, kernel memory corruption that might be leveraged for arbitrary code execution given additional local privilege.