An eventfs inode that has been freed may be iterated over through a SRCU protected list using the wrong field of the union, causing the iterator to read a corrupted pointer. This race condition allows an attacker with sufficient local privileges to trigger a use‑after‑free scenario that can corrupt kernel memory, potentially resulting in a crash or exploitation for privilege escalation. The flaw originates from missing memory barriers and incorrect handling of the list field during free and iteration operations.

All Linux kernel builds that include the eventfs subsystem are affected until the patch is applied. The vulnerability specifically involves kernel code that manages eventfs inodes, and any version prior to the commit that introduces the correct list handling and memory barriers is vulnerable.

The CVSS score is not disclosed, and no EPSS data is available, so the exact exploit probability is unknown. However, the flaw involves a low‑level kernel memory corruption and has not been listed in the CISA KEV catalog. The likely attack vector is local; an attacker must be able to trigger the freeing of an eventfs inode while another process is traversing the list. Given the nature of the vulnerability, the impact of successful exploitation includes possible denial of service and privilege escalation to kernel level, warranting prompt remediation.