The flaw exists in the Linux kernel misc subsystem. When the nsm misc driver is built as a module, opening the character device /dev/nsm installs its file operations without setting the module owner reference. This allows a file descriptor to remain open after the kernel module is removed with rmmod. Subsequent ioctl calls through that descriptor invoke code from unloaded module memory, which can cause a kernel panic or, if the attacker controls ioctl parameters, arbitrary code execution with kernel privileges. The kernel patch resolves the issue by assigning nsm_dev_fops.owner to THIS_MODULE, thereby holding a reference to the module while any file descriptor is open.

All Linux kernel builds that expose the nsm misc driver as a loadable module are affected. The vulnerability is not tied to a specific distribution or kernel version; any system that incorporates the nsm driver in module form and provides /dev/nsm could be impacted. The vendor identified is Linux.

The CVSS score of 7.8 indicates high severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the immediate future. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is local: an attacker would need the ability to load or unload kernel modules, which normally requires root privileges. While a kernel crash is possible, an attacker could potentially craft ioctl parameters that trigger code execution, making the flaw a serious local privilege escalation vector.