A critical use-after-free vulnerability in the Linux kernel exFAT driver, triggered by malicious file system images, poses a significant risk of system compromise.

The flaw resides in the exfat_find_dir_entry function, where a buffer head is released before its data is accessed. An unauthenticated attacker can exploit this race condition using a crafted exFAT image to trigger a use-after-free state, leading to potential kernel-level memory corruption.

This vulnerability carries a CVSS score of 9.8, reflecting its potential for remote code execution with kernel-level privileges. Successful exploitation could lead to total system compromise, unauthorized data access, and persistent denial-of-service conditions, severely impacting business continuity and data integrity.

Immediate Action: Apply the vendor-supplied kernel patches by updating to version 5.10.260, 5.15.211, 6.1.177, or 6.6.144 (or later) immediately.

Proactive Monitoring: Monitor system logs for kernel panics or unusual memory access errors, particularly when mounting external storage devices.

Compensating Controls: Restrict the mounting of untrusted or unknown exFAT-formatted storage devices on critical production systems as a preventative measure.

Public Exploit Available: No

Given the critical severity of this kernel-level flaw, immediate patching is essential to prevent potential system-wide compromise. Security teams should prioritize updating Linux kernel deployments and exercise caution when interacting with untrusted exFAT media until patches are applied across the environment.