A race condition occurs between the sys_timer_delete system call and the exec() operation in the Linux kernel, which can lead to a Use‑After‑Free of a POSIX CPU timer object. When the timer is freed while still referenced in the kernel’s timer queue, subsequent timer operations may dereference the invalid pointer and corrupt kernel memory. This flaw could impact the integrity and confidentiality of system state; it is inferred from the description that an attacker who can trigger the race might be able to influence kernel memory, potentially leading to privilege escalation, but the record itself does not confirm exploitation of elevated privileges.

All Linux kernel builds that have not incorporated the commit series described in the CVE references are potentially vulnerable. No explicit version ranges are listed in the record, so any kernel compiled before the listed fixes may be at risk. The impact is limited to Linux kernels that implement POSIX CPU timers as described.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1 % suggests the likelihood of exploitation in the wild is low. The issue is not yet in CISA’s KEV catalog. Based on the description, the likely attack vector is local and requires an attacker to perform a race between creating or deleting a CPU timer and executing a new program. Systems running on weakly ordered architectures are mentioned as potential risk amplifiers, but no specific hardware requirement is enforced.