In the Linux kernel’s rxrpc module, a race condition between the preallocation worker and the service teardown causes a use‑after‑free. The worker reads the backlog pointer without proper synchronization while another routine frees the backlog structure, so the worker continues to use freed memory and corrupts kernel memory. This corruption can enable execution of arbitrary code with kernel privileges or trigger a system crash. The weakness involves a dangerous race condition and a use‑after‑free scenario.

All Linux kernel builds that include the rxrpc module and are older than the commit that introduced the synchronization fix are vulnerable. Since no specific version ranges are listed, any kernel earlier than that patch should be considered at risk.

The CVSS score of 9.8 reflects the critical severity of a kernel privilege escalation. The EPSS score of < 1 % indicates a very low but nonzero probability of exploitation and the vulnerability is not listed in the CISA KEV catalog. No public exploits have been documented. The likely attack vector is a local attacker who can trigger the race by manipulating the rxrpc service, or exposure of the rxrpc protocol to untrusted traffic. The overall risk remains high because of the severity, but the exploitation likelihood is currently low.