The vulnerability arises from the way the Linux kernel allocates pseudo dentries for special file objects such as pipes and sockets. These dentries are normally short‑lived and freed immediately, but if they become the root of a mount through a bind operation on /proc/self/fd/<fd>, the kernel can unknowingly operate on a dentry that has already been freed. This race condition can lead to memory corruption or a use‑after‑free scenario, potentially allowing an attacker to execute arbitrary code with kernel privileges.

The affected component is the Linux kernel itself. No specific kernel version range is provided in the advisory, so any system running a kernel that has not yet incorporated the described patch could be vulnerable. All Linux distributions that ship the kernel are potentially impacted unless they have adopted the fix in a newer release.

The exact CVSS score is not disclosed in the advisory, nor is an EPSS score available, so the quantitative likelihood of exploitation is unclear. The lack of a CISA KEV designation means there is no current evidence of exploitation in the wild, but the nature of the flaw—potential memory corruption in privileged kernel code—suggests a high impact if it could be triggered. The attack likely requires the ability to perform a bind mount of a file descriptor that is not subject to other security checks, such as a BPF token file, which may restrict exploitation to privileged or specially configured environments.