The net/iucv subsystem in the Linux kernel contains a use‑after‑free flaw: when a connection is severed, its iucv_path object is freed while queued message notifications still reference the removed object. When those notifications are later drained, the stale pointer is passed to message_receive(), triggering a use‑after‑free that can corrupt kernel memory or, potentially, cause a kernel panic. The patch eliminates this risk by discarding queued notifications when the path is severed.

Any Linux kernel build that includes the net/iucv module is affected. Systems running versions of the kernel before the commit that removes pending iucv_path notifications are vulnerable; standard distributions prior to that change need upgrading.

The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% points to a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. No remote exploitation path is documented; based on the description the flaw likely requires local or privileged access to interact with the iucv subsystem and trigger the use‑after‑free by severing a connection and later draining queued messages.