The Linux kernel’s configfs subsystem mismanages the hash status of a directory entry during removal. When a configfs directory is deleted, the dentry remains hashed until after the rmdir operation completes. In that narrow window, other operations may access the freed config_item, triggering a slab use‑after‑free that KASAN reports as a KASAN bug. This flaw is classified as CWE-825 (Unintended Free on Failure). If successfully exploited, an attacker could corrupt kernel memory, leading to privilege escalation or a kernel panic.

All Linux kernels that ship the pre‑patched configfs implementation are affected. The CNA vendor/product information lists “Linux:Linux” twice, indicating the generic Linux kernel across distributions. Because no specific version ranges are provided, any kernel that had the unpatched configfs code prior to the fix is at risk until the patch is applied.

The CVSS score is 7.0, indicating moderate‑to‑high severity. The EPSS score of less than 1 % suggests a low probability of current exploitation, and the vulnerability is not included in the CISA KEV catalog. Based on the description, it is inferred that local privileged access is required to trigger the flaw, as the rmdir operation on a configfs entry must be performed by a user or process with sufficient permissions. If an attacker can gain such access or a privileged process is compromised, the narrow fault window can be reached. Therefore, while nationwide exploitation is unlikely, systems with weak privilege isolation or running unpatched kernels should take remediation promptly.