The Linux kernel’s IUCV networking subsystem contains a use‑after‑free flaw: the function that receives a socket after a read lock is released passes the socket to a callback without retaining a reference. If the socket is closed concurrently, synchronous deallocation frees the object while the callback still accesses it, causing corrupted kernel memory that can be exploited to execute arbitrary code with kernel privileges.

All Linux kernel versions that include the IUCV subsystem before the upstream commit that introduces a reference hold in afiucv_hs_rcv() are affected. Because the vulnerability was fixed by that commit, any kernel older than the patched revision is considered vulnerable.

Based on the description, it is inferred that the exploit requires local access to create or close IUCV sockets and precise timing to race the unlock and callback. The CVSS score is 8.8 and the EPSS score is < 1%, and the CVE is not listed in KEV. The use‑after‑free nature of the bug and its potential to corrupt kernel memory make it a risk that attackers with local privileges could leverage to gain elevated privileges or compromise system integrity.