A high-severity use-after-free vulnerability in the Linux kernel irq_work subsystem allows local authenticated users to compromise system integrity and availability.

This is a use-after-free flaw in the irq_work_single function under PREEMPT_RT, triggered by premature freeing of work items during synchronization and requiring low local privileges.

A successful exploit of this vulnerability can lead to complete system compromise, including arbitrary code execution, privilege escalation, and kernel panic resulting in system downtime. Although the attack vector requires local access and low privileges, the CVSS score of 7.8 reflects the severe impact on confidentiality, integrity, and availability within multi-tenant or shared server environments.

Immediate Action: Update the Linux kernel to version 6.1.175, 6.6.142, 6.12.92, or 6.18.34, or apply the official patches provided in the upstream Git repository.

Proactive Monitoring: Monitor system logs for unexpected kernel panics, segmentation faults, and unauthorized attempts to execute local administrative commands.

Compensating Controls: Restrict local shell access to trusted users only and implement strict principle of least privilege policies on all host systems.

Public Exploit Available: No

Administrators managing systems utilizing PREEMPT_RT Linux kernels must prioritize applying the latest stable kernel updates immediately. Securing local environments against unauthorized shell access is essential until patches can be deployed across the infrastructure.