The Linux kernel contains a use‑after‑free bug in the /proc/allocinfo interface that is triggered when a module is unloaded while the iterator is still active. The iterator state is cached between reads, and after the module’s memory is freed the reader dereferences pointers that no longer reference valid memory. The official description does not assert that this flaw leads to arbitrary code execution; it could potentially corrupt kernel memory or enable a privilege escalation if a privileged attacker exploits it. The primary impact is thus kernel memory corruption with the possibility of more severe compromise if additional vulnerabilities are chained.

All Linux kernel releases that have not incorporated the patch referenced in the advisory are potentially vulnerable. No specific version numbers are listed in the CNA data, so any kernel version before the patch commits should be considered at risk.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of < 1% suggests a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker with root or other privileged rights, capable of reading /proc/allocinfo and unloading kernel modules, could trigger the use‑after‑free. Successful exploitation would allow the attacker to corrupt kernel memory, potentially leading to privilege escalation or system instability.