In the Linux kernel the find_pos_and_ways() error path releases a reference to a switch decoder before logging the error message that includes the decoder name. If that reference was the last one the decoder can be freed before the log accesses its name, creating a classic use‑after‑free race. An attacker who can trigger the error could cause a crash or corrupt kernel memory, potentially allowing escalation of privileges or denial of service. The vulnerability arose from an incorrect order of reference release and error reporting.

The flaw exists in the Linux kernel for all versions that contain the CXL region code path before the patch from commit 15da704b7. The CPE identifies the product as the Linux kernel generically; no specific version list is provided, so all pre‑patch kernels running the affected code are impacted.

The CVSS score is not listed, but the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a privileged or local process that can exercise CXL region operations, as the bug is in kernel space. Exploitation would require inducing the specific error path, which is nontrivial but could be achieved via crafted device or driver interactions. Overall the risk is moderate: high severity if exploited, but low likelihood under current threat landscape.