A race condition exists in the Linux kernel’s SCSI tape driver where the removal routine drops the tape reference before the tape is fully unpublished from the IDR, permitting a concurrent open operation to acquire a stale reference and access freed memory. This results in a use‑after‑free that triggers a kernel panic, as evidenced by KASAN logs. The bug’s impact is a system crash, effectively a denial of service at the kernel level, and could potentially be escalated to arbitrary code execution if an attacker controls the memory contents during the race, although such exploitation is not documented in the current description.

All Linux kernel implementations that contain the legacy SCSI tape driver ("st") before the applied patch are susceptible. The CVE data does not specify discrete kernel versions, so any distribution whose kernel includes the st driver in its pre‑fix state is considered affected. This includes the standard kernel shipped with most Linux distributions and any custom kernels that retain the module in the older configuration.

Based on the description, the likely attack vector is local, requiring privileged or specific device permissions. No CVSS or EPSS scores are reported, and the vulnerability is not listed in CISA’s KEV catalog, which suggests a low to moderate prevalence. The race requires that a process holds both the remove and open APIs concurrently, indicating that elevated privileges or a dedicated user with access to the SCSI tape device is necessary to trigger the condition. An attacker with local or privileged access could exploit this to crash the kernel, but the likelihood of remote exploitation without privileged compromise is low.