A use‑after‑free flaw in the Linux kernel’s ipe module triggers when a new policy is audited after the directory inode lock is released. A concurrent delete can free the policy while the audit function is still referencing it, causing kernel memory corruption. If an attacker can perform a policy load and initiate a delete during the audit, the flaw could allow them to execute code in kernel mode, effectively enabling privilege escalation.

All Linux kernel versions that include the ipe subsystem and support policy loading are potentially vulnerable. The CVE does not list specific affected kernel releases, so any system running a pre‑patch kernel with ipe enabled is at risk.

The vulnerability carries a CVSS score of 4.4, indicating low overall severity, and an EPSS score of <1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The flaw involves kernel memory corruption and requires local or application‑level control over policy loading. Attackers would need to trigger a policy load followed by a delete while the audit runs. Because of the low exploit probability and low severity, the primary risk is limited to a system that is exposed to such conditions, rather than widespread remote exploitation.