The vulnerability is a use‑after‑free in the Linux kernel fprobe subsystem. When an fprobe handler runs while RCU is not watching, synchronize_rcu() fails to wait for those executions, allowing the handler to free memory that is still in use. An attacker could trigger a kernel crash or potentially exploit the memory corruption to execute arbitrary code with kernel privileges. This flaw arises from improper use of RCU synchronization and results in potential denial of service or privilege escalation. The weakness is a use‑after‑free error (CWE‑416) exacerbated by a race condition (CWE‑367).

Affected systems are Linux kernels that have not yet been patched to include the guard(rcu_sched_notrace) change. This includes all common distribution kernels (e.g., Ubuntu, CentOS, RedHat) running versions prior to the commit that introduced the fix.

CVSS and EPSS scores are not available and the vulnerability is not listed in KEV. The likely attack vector is local, requiring an attacker with the ability to register custom fprobe handlers via BPF kprobe‑multi or similar mechanisms. If such access is granted, the use‑after‑free could lead to privilege escalation. No active exploits have been published, but the absence of EPSS suggests a low probability of widespread exploitation. The risk is moderate‑to‑high for systems that run unpatched kernels and permit untrusted code execution in the kernel.