The flaw arises when io_uring_cmd_del_cancelable removes a command from a cancellation list but leaves special poisoning markers in the underlying hash node. Because subsequent requests reuse the same memory without proper reinitialization, the poisoned entries can survive and be interpreted as valid pointers. When a routine later attempts to access the stale data, the kernel aborts with a general protection fault or KASAN wild‑memory‑access crash, leading to a denial of service or kernel panic. Based on the description, the likely attack vector involves a local user or privileged process that can issue crafted io_uring commands to trigger the path that leaves leftover poisoned nodes.

This vulnerability is present in all Linux kernel builds that contain the unpatched io_uring code path, as identified by the CPE for the Linux kernel. Any system running a kernel version prior to those that incorporate the commit cited in the advisory is affected. No specific vendor or distribution is singled out beyond the generic Linux kernel.

Based on the description, the attacker likely needs local or privileged execution to invoke io_uring requests that trigger the bug. The vulnerability results in a memory corruption in kernel space, which typically requires a user with the ability to invoke io_uring commands. The available data show that the CVSS score is not publicly listed, and the EPSS score is unavailable; the vulnerability is not currently tracked in CISA KEV. Consequently, the risk level is primarily a local denial‑of‑service: an attacker could cause the kernel to crash by sending crafted io_uring requests. Because the flaw involves leftover pointers rather than a remote trigger, remote exploitation is unlikely without additional foothold. No immediate workaround exists beyond applying the updated kernel.