The vulnerability involves a race condition in the Linux kernel's dm-verity block driver. During a transition to a new root hash, the old hash is freed while policy evaluation code can still access it. This use-after-free scenario bypasses the read lock protection, allowing kernel memory corruption that could lead to arbitrary code execution or denial of service. The flaw resides in the ipe_bdev_setintegrity path and is tied to the kernel's integrity protection subsystem.

All Linux kernel deployments using dm-verity support and the ipe integrity protection subsystem are potentially affected. The flaw affects the Linux kernel itself; vendor and product details are listed under Linux:Linux in the CNA entry. Exact affected kernel versions are not specified in the provided data.

The vulnerability is a classic use-after-free; an attacker would need local or privilege escalation to trigger the race, as the race occurs within kernel space during dm-verity operations. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, making the exploitation likelihood uncertain. Because the issue is unresolved until the kernel is patched to protect the root hash with RCU, the risk is considered high. The fix requires a kernel update that applies the RCU guard to the root hash.