The vulnerability occurs when the mtd_virt_concat_destroy routine frees the concat structure before releasing the devices attached to it. Subsequent calls to mtd_virt_concat_put_mtd_devices on the freed memory cause a use‑after‑free condition. Exploiting this flaw could allow an attacker with the ability to trigger the destruction routine to corrupt memory, potentially enabling arbitrary code execution or creating a denial‑of‑service.

All Linux kernel releases that include the MTD virt_concat subsystem prior to the fix are affected. The issue is present in the kernel versions that compile the mtd_virt_concat module without the commit that moves the device release before the destroy call. No specific version range is provided.

The CVSS score is not published, and the EPSS score is not available, but the vulnerability remains unlisted in the CISA KEV catalog. The fix indicates the issue is local and requires the attacker to invoke the vulnerable sequence, implying a moderate to high exploitation risk for privileged users or local attackers. No remote attack vector is documented. Given the lack of public exploitation evidence, the risk is considered moderate but requires timely patching.