In the Linux kernel's io_uring subsystem, a race condition in the SQPOLL worker thread causes a use‑after‑free when the final request that keeps the ring alive is processed. The ring context is freed while another task is still referencing it, leading to kernel memory corruption. Based on the description, it is inferred that an attacker could exploit this flaw to achieve privilege escalation or local code execution by corrupting kernel memory.

The vulnerability affects all Linux kernel releases prior to the commit that implements the fix (commit 395b25968fe854d4efaa19a8e9b7a5b6d1b3eea3, referenced in the provided Git URLs). Systems that use io_uring with SQPOLL enabled are at risk; rebooting into a patched kernel version removes the vulnerability. Unpatched kernels will remain susceptible until the patch is applied or the feature is disabled.

The EPSS score is less than 1 % and the flaw is not listed in CISA KEV. The CVSS score is 5.5, indicating moderate severity, and the description shows an attacker with local or privileged access could trigger the race via io_uring activity. This presents kernel memory corruption that could lead to privilege escalation or local code execution.