The cachefiles subsystem of the Linux kernel contained a potential use‑after‑free where the trace_cachefiles_coherency function was given a pointer to a __be64 over a variable‑length buffer that could be zero bytes long. The description indicates a potential use‑after‑free or KASAN warning that could allow memory corruption. Based on the description, it is inferred that an attacker with local access could read or corrupt kernel memory, potentially leading to privilege escalation or a kernel crash. The flaw is a classic use‑after‑free weakness.

All Linux kernel releases that incorporated the original cachefiles_xattr implementation prior to the commit that introduced this patch are affected. This includes any distribution that ships a kernel version containing the vulnerable code before the patch was applied. The precise list of affected kernel versions is not numbered in the advisory, but any unpatched kernel before the commit is at risk.

The EPSS score is < 1% and the CISA KEV catalog does not list this vulnerability, indicating no known widespread exploitation. Based on the description, it is inferred that a use‑after‑free in kernel space could pose a risk for local attackers, potentially enabling arbitrary code execution with root privileges or causing a denial‑of‑service by crashing the kernel. The CVSS score is 5.5, indicating a medium severity.