In the Linux kernel audit subsystem, multiple threads read the audit_queue queue length using skb_queue_len() without acquiring the queue lock or using the READ_ONCE() macro, while the writer thread updates the same counter under a spinlock with WRITE_ONCE(). This unsynchronised access creates a data race that can cause the reported queue length to fluctuate inconsistently, potentially leading to incorrect audit message processing, kernel instability, or a denial of service. The weakness is a classic unsynchronised shared data access (CWE-820).

The vulnerability exists in the Linux kernel audit subsystem in any build that has not yet incorporated the commit replacing skb_queue_len() with skb_queue_len_lockless(). The CVE data does not list specific version numbers, so system administrators should verify whether their kernel contains the fix or contact their distribution for version information.

The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a very low likelihood of exploitation in the wild. No public exploits are known. Based on the description, it is inferred that an attacker would need local privileged access to the audit daemon or kernel to trigger the race condition; thus, the primary attack vector is local privileged execution. The CVSS score of 8.2 reflects a high severity risk for data integrity and availability, but the low EPSS and lack of public exploits reduce the immediate threat level.