The vulnerability is a use‑after‑free (UAF) condition in the Linux kernel netfs subsystem. When netfs_unlock_abandoned_read_pages() is called after the NETFS_RREQ_IN_PROGRESS flag is cleared, it dereferences a folio that has already been released, potentially allowing an attacker to manipulate kernel memory. If an attacker can control the data involved, this UAF could lead to privilege escalation. The weakness is consistent with CWE‑416.

All Linux kernel builds are affected until the fix is applied. The patch moves the reference from an index to a direct folio pointer, correcting the unsafe dereference. Any system running a kernel version before the commit that contains this change remains vulnerable.

The CVSS score of 9.8 indicates critical severity, and the EPSS score is reported to be less than 1 %, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The flaw is a kernel UAF that can be triggered by a local attacker who can manipulate netfs operations; if they can trigger the condition, it would grant root privileges. No public exploit has been reported, but the nature of the flaw warrants immediate attention.