The Linux kernel’s cgroup cpuset subsystem contains a Use‑After‑Free flaw. The helper function is_in_v2_mode() may read a stale cpuset_cgrp_subsys.root pointer when the cpuset filesystem is rebound, which could trigger a kernel fault. Because the pointer is used by privileged kernel code, an attacker who can cause the stale read might execute code at kernel level, leading to a kernel crash or privilege escalation. The patch resolves the issue by adding a cpuset_v2_mode flag that is written only after a stable cpuset bind and by changing is_in_v2_mode() to read that flag instead of the potentially stale root pointer. This is an instance of CWE-825 weakness.

The flaw affects all kernel builds that include the cgroup cpuset subsystem and have not incorporated the commit that replaces the unsafe root pointer with the cpuset_v2_mode flag. Because no specific version list is supplied, any kernel that has not applied the patch and that mounts the cgroup cpuset filesystem is potentially vulnerable. Users of recent stable kernels that have not yet received the fix should verify against commit 988bf67a13890a37a33201f95947095ca9bec856.

The CVSS score is 4.1, indicating low severity, while the EPSS score is <1%, demonstrating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or privileged, requiring an attacker to trigger a stale read by rebinding the cpuset filesystem, which could result in a crash or local privilege escalation. No public exploits have been reported, but the kernel‑level nature of the defect warrants prompt attention.