This vulnerability occurs in the Linux kernel’s MTD virt_concat subsystem. After the item’s concatenation structure is freed by mtd_concat_destroy(), the function mtd_virt_concat_put_mtd_devices() may still reference that memory. The resulting use‑after‑free can corrupt kernel memory, trigger a crash, or allow an attacker to execute arbitrary code with kernel privileges. The weakness is a classic use‑after‑free bug (CWE‑416).

The issue exists in all Linux kernel builds that include the MTD virt_concat driver before the patch that moves the call order. No specific vendor version is delineated; users should audit their kernel version against the commits referenced in the advisory or apply the corresponding upstream fix.

The CVSS base score and EPSS are not publicly available, but use‑after‑free bugs are typically regarded as high‑severity because they give an attacker a path to gain kernel‑level execution. The KEV status is not listed. The likely attack vector is a local attacker who can trigger the vulnerable code path, possibly through privileged access to MTD devices or by exploiting other kernel interfaces that interact with virt_concat. No remote exploitation path is documented, so the risk focus is on privileged or local contexts. Based on the description, it is inferred that the victim must be able to engage the MTD virt_concat subsystem to trigger the bug. Given the lack of EPSS data, no quantitative exploitation probability can be asserted at this time.