The vulnerability arises in the Linux kernel’s configfs subsystem when a directory entry remains hashed after a removal operation, causing a use‑after‑free condition in config_item_get. This flaw can lead to kernel memory corruption and, if exploited, arbitrary code execution or system crash. The weakness is a classic Use‑After‑Free error, classified as CWE‑416.

All Linux kernel versions containing the current configfs implementation before the patch that removes the stale hash are affected. The vendors listed are Linux:Linux, indicating that any distribution shipping an unpatched Linux kernel is potentially vulnerable. No specific affected version string is provided, so all legacy kernels should be treated as at risk until a patch is applied.

The CVSS score and EPSS data are not available in the supplied information, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires local access to the kernel’s configfs interface, so a privileged user (or a compromised process with kernel‑space code execution capabilities) could trigger the critical use‑after‑free window. If an attacker can trigger rmdir operations on the configfs tree, the window where the dangling reference is still reachable exists until the d_delete unhash call after the rmdir return, creating a narrow but exploitable timing window. In the absence of a publicly available patch, the risk is high for systems that expose configfs to untrusted users.