When PSI scheduling work runs on the Linux kernel hotpath without acquiring the appropriate lock, it can concurrently execute with the destruction of the PSI rtpoll trigger. The timer remains active when the cgroup is freed, resulting in the timer callback accessing freed memory. This use‑after‑free can cause a kernel panic; a local attacker might exploit this for denial of service. The vulnerability is rooted in a concurrency race and memory corruption.

The flaw affects the Linux kernel across all builds that include the PSI rtpoll timer; no specific kernel version range is provided. Any system running a Linux kernel that implements PSI rtpoll triggers is potentially vulnerable and should verify whether the patch has been applied.

Although no public exploit is available and EPSS is not reported, the use‑after‑free in kernel code is highly severe. A local user could trigger the race by manipulating PSI scheduling or creating and deleting cgroups, potentially leading to denial of service. Privilege escalation has not been documented but remains uncertain. The vulnerability is not listed in CISA KEV and the CVSS score is unspecified, but its nature warrants urgent attention from affected Linux users.