The vulnerability arises from the absence of proper locking when traversing the configfs child directory list. While the parent directory lock prevents removal, it does not guard against concurrent changes to the child pointers by lseek() or freeing procedures. During such unsynchronized accesses a malicious thread could reorder the child pointers, causing the configfs cursor to reference freed or relocated memory. The resulting kernel memory corruption can lead to arbitrary code execution or a system crash.

Both mainline Linux kernel builds that have not yet incorporated the fix are affected. The commit identifiers in the references indicate a patch applied to the upstream repository, but the exact kernel version is not specified in the data. Consequently, any host running a Linux kernel before the application of this patch could be vulnerable. The vulnerability exists in the configfs subsystem across all variants of the Linux kernel.

The CVSS score of 7.8 indicates a high severity, and the EPSS score is < 1%, signifying a low estimated exploitation probability. Although the vulnerability is not listed in the CISA KEV catalog, kernel memory corruption remains a serious flaw. This implies that a local attacker with sufficient privileges could execute a race condition to achieve kernel-level execution. The risk remains considerable until the patch is applied, and the likelihood of exploitation depends on the attacker's ability to perform code execution within the kernel context on the target system.