An eventfs inode that has been freed can be re‑iterated over a SRCU protected list using an incorrect field of a union. This allows a reader to access the "rcu" head instead of the intended "list" and read a corrupted pointer, resulting in a use‑after‑free that corrupts kernel memory. The flaw arises from treating a union of an rcu list head and a children list without proper memory barriers or checks for freed objects.

All Linux kernel builds that incorporate the eventfs subsystem and were shipped prior to the commit that adds proper list handling, memory barriers, and the is_freed check are affected. The patch removes the vulnerability by separating the union, setting the freed flag, and inserting smp_wmb and smp_rmb barriers during free and traversal, respectively.

The CVSS score of 7.8 reflects a high severity impact, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need local privileges and a scenario where an eventfs inode is freed concurrently with another process iterating the list. Successful exploitation may cause a kernel crash or, if the attacker can manipulate the memory used for the list, a privilege escalation to kernel level.