The flaw occurs when the destroy routine frees a concat structure before the attached devices are released. As a result, a subsequent call to release the devices accesses freed memory, creating a use‑after‑free condition. Based on the description, it is inferred that an attacker who can trigger the destruction routine could corrupt memory, potentially enabling code execution or causing a crash.

Any Linux kernel that contains the MTD virt_concat subsystem before the fix is vulnerable. The vulnerability is present in versions that compile the module without the commit that moves the device release before the destroy call, but no specific version range was enumerated.

The CVSS score is 5.7 and the EPSS score is less than 1 %. It is not listed in the CISA KEV catalog. The likely attack vector is local, requiring the ability to invoke the destructive sequence, which typically implies privileged or local access. No remote exploitation path is documented. These facts suggest the risk is moderate; timely patching is advisable.