The vulnerability resides in the Linux kernel’s real‑time spinlock implementation. In rt_spin_unlock() the RCU read lock is released prematurely, creating an observable race that can cause a use‑after‑free. An attacker who can orchestrate the illustrated timing can free a kernel object while it remains referenced, resulting in an undefined state that can be exploited to run arbitrary code with kernel privileges.

All Linux kernel releases containing the rt_spin_unlock() function before the patch that reorders the rcu_read_unlock() call are vulnerable. This includes every kernel version that has not yet integrated the commit series referenced in the advisory.

The CVSS score is 9.8, indicating critical severity, and the flaw is not listed in CISA KEV, indicating limited known exploitation. The EPSS score is <1%, suggesting a very low probability of exploitation. However, the flaw is a classic use‑after‑free capable of local privilege escalation. Exploiting it requires orchestrating a race between threads holding the real‑time lock and those holding RCU read locks; while difficult, it could allow an attacker with access to privileged code paths to execute arbitrary code in kernel mode.