A timing flaw between the cgroup write‑back unmount routine and the inode switch logic triggers a BUG_ON in the VFS layer when a container exits. The race leads to a use‑after‑free of inode structures and a fatal kernel panic, effectively shutting down the host or its containers. The vulnerability does not grant code execution or privilege escalation; it simply brings the system to a halt.

Any Linux kernel that lacks the commit that expands the RCU read‑side critical section and inserts a synchronize_rcu() before flush_workqueue() is vulnerable. The issue has been observed in the stable 5.10.y and 6.6.y branches and is fixed in subsequent mainline releases. All distributions shipping those kernel versions are affected unless an out‑of‑the‑box patch has been applied.

The CVSS score of 7.8 indicates a high impact, but the EPSS score of less than 1 % suggests a very low likelihood of exploitation in the wild. The flaw requires an attacker to trigger a container exit at a precise moment, making it a local, self‑contained denial‑of‑service vector rather than a remote code‑execution risk. With no listing in the CISA KEV catalog, no known active exploits are documented. Overall, the risk remains moderate to low under normal operational conditions, but the severity of a kernel crash warrants prompt remediation.