The kernel bug occurs during traversal in the Network per‑inode file locks. The current implementation increments a reference on the current file does not pin the saved next pointer. A concurrent release frees the next file while the iterator still holds a reference, causing a use‑after‑free. The kernel may dereference freed memory on the next loop iteration, corrupting memory and potentially allowing a local privileged attacker to execute arbitrary code or crash the system. The weakness is a classic buffer dereference after memory has been freed (CWE‑825).

All Linux kernel installations prior to the patch are affected. No specific kernel release numbers are provided, so until the patch commit is applied, every Linux host using the kernel should be considered vulnerable. The vulnerability is present in the kernel's lockd component and applies to all current releases until the update is applied.

The CVSS score is 5.3, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability requires local or privileged access to the kernel because it depends on concurrent nlm_release_file() calls, which are normally invoked by processes that hold file locks. Therefore the exploitability is low to medium; a local attacker could potentially exploit the race condition. The risk remains moderate due to the potential for arbitrary code execution in kernel space.