The Linux kernel vulnerability arises from the ims_pcu_disconnect() function incorrectly assuming that only the control interface triggers cleanup. By using the interface class to differentiate control and data interfaces, an attacker can supply a data interface that mimics the control interface’s class. This causes the kernel to perform premature cleanup, resulting in a use‑after‑free or double‑free condition that could allow execution of arbitrary code with kernel privileges, thus enabling privilege escalation.

All Linux kernel releases that do not contain the commit that validates the control interface in ims_pcu_disconnect() are affected. The vulnerability exists in kernels prior to the inclusion of commit 293388e42e5c0865204de6f36bfb8662156fce3b. Any system running a kernel version lacking this patch is vulnerable.

The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation. The likely attack vector involves a malicious device that can connect to the IMS‑PCU interface and present a data interface with the same class as the control interface. Exploitation would require local access to the device connection layer, making remote attacks improbable but still possible if an attacker gains physical or virtual device access. Because the flaw permits kernel‑level code execution, the risk warrants immediate remediation.