A use-after-free vulnerability in the Linux kernel key management subsystem allows local low-privileged users to achieve high system impact, including potential code execution.

This flaw is a use-after-free vulnerability within the keys subsystem, specifically involving race conditions during the instantiation paths of request_key_auth payloads, requiring low local privileges and no user interaction.

A successful exploit of this vulnerability could allow a malicious local user to gain full control over the affected operating system instance, resulting in complete confidentiality, integrity, and availability compromise. The assigned CVSS score of 7.8 indicates a high severity rating, reflecting the potential for local privilege escalation and system compromise despite requiring local access.

Immediate Action: Update the Linux kernel to the latest patched stable version, such as 5.10.260, 5.15.211, 6.1.177, 6.6.144, or later, depending on the active release branch.

Proactive Monitoring: Monitor system logs for unexpected kernel panics, segmentation faults, or unauthorized local execution attempts that may indicate exploitation activities.

Compensating Controls: Restrict local shell access and implement strict principle-of-least-privilege controls to minimize the number of users capable of executing arbitrary code locally.

Public Exploit Available: false

System administrators managing Linux environments must prioritize applying the latest kernel updates provided by their distribution vendors. Prompt patching of this use-after-free flaw is essential to prevent local privilege escalation and maintain the security posture of the host operating system.