The vulnerability is a use‑after‑free flaw in the Linux kernel’s irq_work_single() routine when the kernel is compiled with the PREEMPT_RT real‑time patch. After clearing a busy flag, the routine still accesses work data that may have already been freed by a concurrently executed irq_work_sync() call, causing the kernel to dereference invalid memory. This can lead to data corruption or a crash within privileged kernel space.

All Linux kernel builds that include the PREEMPT_RT patch before the commit that introduces the fix (for example commit 18c0456ea2615b1a743a6db739c74411c3b42bc6) are affected. No particular kernel version numbers are listed, so any PREEMPT_RT enabled kernel lacking that change is considered vulnerable.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1 percent indicates a low likelihood of exploitation at present. The flaw resides in privileged kernel code, so a local attacker would need kernel‑level access to exploit it; this inference is based on the nature of the bug, as the description does not state explicit privileges. Exploitation requires a narrow concurrency window between irq_work_sync() and irq_work_single(), reducing the attack surface.