The Linux kernel contains a use‑after‑free bug (CWE-825) involving the thread_pid reference during process teardown. A recent commit removed the reference to thread_pid when calling proc_flush_pid(), but the reference may already be freed by a concurrent RCU callback. The race between wait4(-1) and setsid() can trigger this oversight, resulting in a KASAN‑detected read of a freed pid cache object and a kernel crash. No privilege escalation or data leak can be achieved; the flaw primarily causes a denial‑of‑service.

Vulnerable kernels include Linux kernel releases prior to 6.19, as well as the 6.16.y through 6.18.y series before the backport of the fix. The patch is included in the mainline v6.19 and newer kernels. Systems running older releases, whether built from source or packaged by distributions, require a backport of the commit or a distribution update that applies the same change.

The CVSS score of 7.8 indicates high severity, and the EPSS score of < 1% indicates a very low exploitation probability. The KEV status is not listed, meaning no known active exploitation is reported. The flaw can be triggered locally by any unprivileged user on vulnerable kernels, providing a straightforward denial‑of‑service vector. No privilege escalation or data leak can be achieved; the risk is limited to availability and system stability. The ability to crash the kernel still represents a moderate to high impact for environments that cannot tolerate downtime.