The vulnerability originates in the Linux kernel’s futex subsystem, where a use‑after‑free occurs during the final put of a private hash structure. When the reference count drops to zero, the kernel drops preemption, allowing another task to free the hash’s memory. The original task later resumes and reads the freed kmalloc‑512 allocation, causing a stale mm pointer to be used in a wake_up_var() call. This kernel memory corruption can be exploited to modify kernel data structures and potentially elevate privileges or crash the system.

The flaw affects any Linux kernel build that includes the unpatched futex implementation. No specific version range is provided; any kernel version prior to the inclusion of the patch contains the vulnerability.

No EPSS score is available and the flaw is not listed in the CISA KEV catalog, indicating limited exploitation data. The attack requires an attacker to trigger a futex operation that leads to the reference count dropping to zero, implying a local or privileged attacker context. If such conditions are met, kernel memory corruption may be introduced, potentially enabling privilege escalation. The CVSS score is not specified, so risk assessment remains qualitative based on the described use‑after‑free weakness.