The vulnerability is a race condition in the Linux kernel’s vduse device driver. During device open, the kernel looks up the device struct via an IDR and releases the global vduse_lock before acquiring the device’s own lock. A concurrent destroy operation can remove and free that struct in the window, causing a use‑after‑free. Because the flaw corrupts kernel memory, an attacker could execute arbitrary code in kernel mode, resulting in privilege escalation. The weakness is a classic use‑after‑free scenario, corresponding to CWE‑367.

All Linux kernel releases built before the commit that adds the lock‑ordering change are affected. The flaw exists in the vduse device driver component of the kernel, so any system running a vulnerable kernel version is susceptible, regardless of distribution.

The CVSS score of 8.8 marks this as a high‑severity memory corruption vulnerability. The EPSS score of <1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation yet. An attacker would need local access and the ability to load or interact with the vduse driver to trigger the race; thus, privileged or capable users can mount the attack, while standard users cannot.