The Linux kernel contains a use‑after‑free flaw in the rxrpc subsystem’s rxgk_issue_challenge() function. The function frees the memory page that holds the challenge content after a tracepoint is invoked; the tracepoint’s whdr still points to that freed page, leaving a dangling reference. If an attacker can manipulate the sequence in which the tracepoint and memory freeing occur, they can read or execute code via the freed pointer. This type of flaw can allow arbitrary code execution or privilege escalation, depending on the context in which the memory is accessed. The likely attack vector is a remote attacker sending specially crafted RxRPC packets, but this inference is not explicitly stated in the CVE data.

All Linux kernel releases prior to the patch are affected. The product is the Linux Kernel; any distribution or custom kernel that has not been updated to the patched version remains vulnerable. No specific version numbers are listed in the CVE data, so any system installing a kernel from before the patch is potentially at risk. It is inferred that all kernel versions before the patch commit are vulnerable because the CVE data does not list specific versions.

The vulnerability has a CVSS score of 9.8, indicating a critical severity. The EPSS score of < 1% indicates a very low probability of exploitation. The issue is not listed in the CISA KEV catalog, and the presence of a dangling pointer in a core networking protocol suggests that, if exploited, the flaw could enable kernel code execution. Based on the description, the attack path is inferred to involve a remote attacker sending specially crafted RxRPC packets that trigger the freed reference, or a local attacker with the ability to influence rxrpc traces. Because the flaw is in kernel space, exploitation results in uncontrolled kernel code execution, effectively bypassing user‑space protections.