A use‑after‑free flaw exists in the Linux kernel’s iucv subsystem. When an iucv connection is severed, the associated iucv_path is freed while still queued in message notifications. A later drain of the queue reuses the now‑stale pointer, causing a use‑after‑free. This can corrupt kernel memory or trigger a crash, thereby compromising system stability and potentially allowing denial of service or further exploitation if an attacker can influence the iucv path processing.

All Linux systems running a kernel that includes the unpatched iucv_path management in the net/iucv module are affected. The specific kernel version is not listed, but any release prior to the commit that removes the dangling notifications is susceptible.

The vulnerability is a classic use‑after‑free (CWE‑416) and is inherently a local kernel issue; it requires an attacker to trigger the path severing and subsequent message processing from within the system. No public EPSS score or KEV listing is available, indicating low exploitation probability at present. However, if exploited, it could cause a kernel panic or memory corruption, potentially yielding elevated privileges if the attacker can influence kernel execution paths. The attack vector is inferred to be local or privileged, as the flaw manifests only when an iucv socket is closed after queued messages remain.