The vulnerability is in the Linux kernel’s real‑time spinlock implementation. In rt_spin_unlock() the RCU read lock is released too early, creating a race that can lead to a use‑after‑free. An attacker who can trigger the described timing example can cause a kernel object to be freed while still referenced, creating an undefined state that can be abused to execute arbitrary code with kernel privileges.

Linux kernel versions that have not yet incorporated the commit series that reorders the rcu_read_unlock() call in rt_spin_unlock(). No explicit version range is given, but any kernel containing rt_spin_unlock() before the patch is vulnerable.

The CVSS score is not provided and the flaw is not listed in CISA KEV, indicating limited known exploitation. However, the flaw is a classic use‑after‑free capable of local privilege escalation. Exploiting it requires orchestrating a race between threads holding the real‑time lock and those holding RCU read locks; while difficult, it could allow an attacker with access to privileged code paths to execute arbitrary code in kernel mode.