The vulnerability is a use‑after‑free in the Linux kernel fprobe subsystem. When an fprobe handler runs while RCU is not watching, synchronize_rcu() fails to wait for those executions, allowing the handler to free memory that is still in use. An attacker could trigger a kernel crash or potentially exploit the memory corruption to execute arbitrary code with kernel privileges. This flaw arises from improper use of RCU synchronization and results in potential denial of service or privilege escalation. The weakness is a use‑after‑free error (CWE‑416) exacerbated by a race condition.

Affected systems are Linux kernels that have not yet been patched to include the guard(rcu_sched_notrace) change. This includes all common distribution kernels (e.g., Ubuntu, CentOS, RedHat) running versions prior to the commit that introduced the fix.

The CVSS score is 4.7 while the EPSS score is less than 1 percent, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an attacker with the ability to register custom fprobe handlers via BPF kprobe‑multi or similar mechanisms. If such access is granted, the use‑after‑free could lead to privilege escalation. No active exploits have been published, but the absence of widespread exploitation indicators suggests a low probability of widespread exploitation. The risk is moderate‑to‑high for systems that run unpatched kernels and permit untrusted code execution in the kernel.