A race condition in the Linux kernel psi subsystem can lead to a use-after-free vulnerability, potentially allowing a local attacker to achieve code execution or system instability.

The vulnerability exists in the psi_cgroup_free function, where a race condition between the scheduler hotpath and cgroup destruction can leave a re-armed timer active on freed memory. An attacker with low privileges can trigger this use-after-free condition to cause system crashes or potentially escalate privileges.

Successful exploitation of this flaw allows a local, authenticated user to trigger a kernel panic, leading to denial of service, or potentially execute arbitrary code with kernel-level privileges. Given the CVSS score of 7.8, this vulnerability poses a high risk to system integrity and availability, particularly in multi-tenant environments or shared hosting platforms where users have local access.

Immediate Action: Update the Linux kernel to version 5.10.266, 5.15.217, 6.1.183, 6.6.152, or later, depending on the active stable release branch.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults that may indicate attempts to trigger memory corruption errors.

Compensating Controls: Limit access to the system to trusted users only, as the attack vector requires local, low-privileged access to the system.

Public Exploit Available: Unknown.

This vulnerability represents a significant stability and security risk to Linux-based infrastructure. Administrators should prioritize patching the kernel across all environments, particularly those supporting untrusted local users. Please consult your distribution vendor for backported security patches if you are running a vendor-specific kernel release.