A double decrement of the descriptor_busy reference counter in the gpib command_ioctl() path overflows the counter to –1, re‑enabling a use‑after‑free that the original patch intended to stop. When a concurrent close_dev_ioctl() operation checks the counter and finds it zero, it frees the descriptor while it is still in use, allowing an attacker to corrupt kernel memory or execute arbitrary code.

All Linux kernel builds that compiled with the GPIB module before the commit that zeroes the counter correctly. This includes every distribution kernel with the bug present, because the vendor list lists Linux as the affected product. The exact version range is not specified in the CVE data, so any kernel prior to the application of commit d1857f8296dc is vulnerable.

The bug carries a high potential impact – aborting the kernel or enabling privilege escalation – and is likely exploitable in a local context where an attacker can trigger the conflicting ioctl calls; the CVSS score of 7.8 indicates a high severity. The EPSS score is very low (<1%), indicating a low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog, but the seriousness of a use‑after‑free in the kernel warrants a cautious assessment.