The Linux resctrl subsystem can be exploited when an unmount or teardown operation frees monitoring event file private data without marking the default resource group as deleted. A concurrent reader that had previously opened a monitoring file may wake after the race and dereference the freed private data, triggering a use‑after‑free that can crash the kernel. Based on the description, it is inferred that an attacker must have local access to a monitoring file within the resctrl filesystem to trigger the race.

All Linux kernel releases that do not include the patch adding the RDT_DELETED flag are potentially vulnerable. The vulnerability applies to systems with the resctrl filesystem enabled; the explicit affected kernel versions are not listed, so the issue can be assumed to exist in any unsupplemented kernel prior to the fix. The impact is confined to the resctrl component of the kernel, but the state change can affect overall system stability.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a very low exploitation likelihood. Based on the description, it is inferred that local access to the resctrl monitoring file, combined with a race between a reader and an unmount operation, limits the attacker's opportunity. Because it can cause a kernel panic, the potential damage is significant even though the likelihood is low, and it is not listed in the CISA KEV catalog. This information infers that the vulnerability is a local, race‑condition‑based denial of service with a high impact but low likelihood of exploitation.