The vulnerability is a classic use‑after‑free in the Linux kernel interconnect subsystem. When a path object's name allocation fails, the object is prematurely freed while still linked into request lists, leaving dangling pointers. Subsequent operations on these corrupted lists cause kernel memory corruption, which can lead to system crashes or, in some scenarios, privilege escalation. The weakness is classified as CWE‑825.

This flaw affects all Linux kernel releases that include the interconnect driver and use the affected functions. The raw CPE shows the entire kernel family, so any distribution kernel that has not been patched after commit 25c7e242… remains vulnerable. No specific vendor or version notation is included in the CNA data, so all unpatched kernels are at risk.

The CVSS score of 4.7 indicates low severity. EPSS < 1% points to a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers need local access and sufficient privileges to invoke the vulnerable interconnect functions. The likely attack vector is local, possibly via debugfs or privileged services. Based on the description, it is inferred that this can lead to denial of service and potentially privilege escalation. Overall risk is low to moderate. Immediate patching is recommended.