A use‑after‑free flaw in the Linux kernel's ipe module occurs when a new policy is audited after its directory inode lock is released. A concurrent delete can free the policy data while the audit function is still accessing it, leading to kernel memory corruption. If an attacker can trigger a policy load followed by a delete, the flaw could allow arbitrary code execution with kernel privileges, effectively enabling privilege escalation to the root level.

The vulnerability affects all Linux kernel implementations that include the ipe subsystem and that may load new policy files. Because the affected versions are not enumerated in the CVE data, any system running a kernel prior to the patch that supports ipe policy loading could be impacted. This includes most mainstream Linux distributions that ship a recent kernel with ipe enabled.

No CVSS score or EPSS availability is listed, and the vulnerability is not in CISA's KEV catalog. The flaw represents a critical kernel memory corruption that could be exploited by an attacker with local or control over policy loading to gain elevated privileges. The attack requires the ability to load a new policy and trigger a delete while the audit is ongoing; therefore, the primary vector is local exploitation or an application that has the ability to manipulate ipe policies. Given the severity of kernel corruption, the risk remains high even in the absence of publicly available exploitation tools.