In the Linux kernel, a use‑after‑free flaw in the mm/huge_memory module is triggered when a huge anonymous shmem page is split. The kernel releases the i_mmap_rwsem lock before all after‑split folios are safely unlocked, allowing a mapping dereference to occur after the inode is freed. This race condition leads to a kernel‑mode memory corruption that can manifest as a crash or, if an attacker can control the conditions, an escalation of privileges. The vulnerability is a use‑after‑free defect.

All Linux kernel releases that do not include the upstream patch reordering the unlock sequence are affected. Because the CNA does not list specific version ranges, any unsupported or legacy kernel that has not incorporated the fix is potentially at risk. The flaw resides in the core kernel and applies across all distributions that ship the unchanged kernel.

The CVSS score of 7.8 indicates moderate severity, and the EPSS score of <1% suggests exploitation is unlikely at present. Based on the description, it is inferred that a local attacker with sufficient privileges to generate memory pressure or manipulate shmem huge pages could trigger the race condition. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local access and the ability to induce the split operation, leading to a kernel panic or privilege escalation.