A race condition exists in the Linux kernel’s POSIX CPU timer subsystem where a timer can be freed while it remains queued on the expiry list. The change from a tristate 'firing' flag to a simple boolean caused the kernel to misidentify whether a timer was still in use, potentially freeing it during an active expiry handler. The resulting use‑after‑free can corrupt kernel memory and trigger a crash or, in theory, allow a local attacker to influence the kernel state.

The vulnerability affects the Linux kernel itself. All releases prior to the inclusion of commit bf635681c906 are vulnerable. Kernels built from that commit onward incorporate the fix, preventing the race by checking the timer’s queued status before freeing it.

The CVSS score of 7.8 denotes a high‑severity local flaw. The EPSS score of <1% indicates that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The race requires a local attacker to control the creation and deletion of timers, which suggests that while the potential impact is significant, the likelihood of exploitation under normal conditions remains low.