A race condition in the io_uring waitid implementation clears the head pointer before a thread owns the request, creating a use‑after‑free window. If another thread holds a reference to the same request, it can be prematurely released, which may trigger memory corruption and result in a kernel crash, as evidenced by KASAN reports. The CVE description does not explicitly state privilege escalation, but the use‑after‑free can compromise kernel stability.

All Linux kernel builds that include the io_uring subsystem and lack the patch found in commit c10ad2813e are potentially affected. No specific version list is supplied, so any current release that has not been updated to include the defense remains at risk.

The CVSS base score of 7.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires a local process capable of initiating concurrent io_uring waitid operations; no network‑based entry is described. The attack vector is likely local and could lead to denial‑of‑service or, if sufficient control over the freed memory were achieved, privilege‑escalation. The lack of external exploitation evidence further suggests a local threat model.