rt_spin_unlock() releases the RCU read lock before unlocking the real‑time spinlock, creating a race that can lead to a use‑after‑free. When a kernel object is freed while another thread still holds a reference via RCU, the memory may be reallocated for a different purpose, resulting in arbitrary memory corruption. An attacker who can orchestrate the provided timing scenario could potentially execute arbitrary code in kernel mode or crash the system. Based on the description, it is inferred that the attack vector requires a race condition between RCU read lock usage and rt_spin_unlock, as the official advisory does not explicitly state how the exploit is triggered but the presence of a race implies it can be crafted.

All Linux kernel builds that use the unpatched rt_spin_unlock implementation are affected. This includes every kernel release before the commit that reorders the rcu_read_unlock call, as indicated by the links to the commit series. The vulnerability applies to the Linux kernel across all distributions that ship a kernel older than the patched version, regardless of distribution.

The CVSS score of 9.8 signals critical severity. The EPSS score is reported as <1%, indicating a very low probability of exploitation in the wild. The flaw is not listed in CISA KEV, suggesting no known widespread exploitation. However, because this is a classic use‑after‑free that can lead to kernel memory corruption, a local attacker with sufficient privileges to execute code can use it to gain elevated privileges or crash the system. The likely attack vector is a local privilege escalation via a carefully orchestrated race condition, inferred from the described use‑after‑free scenario.