The fault occurs when the FUSE kernel module releases a request lock in fuse_ref_folio() but fails to reacquire it before returning. This missing lock allows the asynchronous cleanup path to free request arguments while other code paths still read them, resulting in a use‑after‑free situation. The weakness aligns with CWE‑416, and the concurrent execution aspect is related to CWE‑362. A subverted memory region could be overwritten, giving a local attacker the possibility to corrupt kernel state and potentially elevate privileges or crash the system.

All Linux kernel builds that incorporate the FUSE module code before the commit adding the lock are affected. The advisory references multiple kernel commit hashes, but specific version numbers are not listed; thus any deployment using older kernel releases with FUSE mounts remains vulnerable until the patch is applied. Exact impacted releases cannot be confirmed without additional version data.

The CVSS score of 7.8 reflects a high severity for local execution. The EPSS score is reported as less than 1 %, indicating a low probability of widespread exploitation, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a local privileged or unprivileged user who can issue operations on a FUSE filesystem; this inference is based on the description of the race condition between user requests and asynchronous cleanup.