A race condition in the Linux kernel UIO subsystem could allow a local authenticated user to trigger a use after free, leading to potential privilege escalation or system instability.

The flaw exists in the UIO device registration path, where a failed setup leaves a stale info pointer in the device structure. An attacker with local access can race against this registration failure to dereference freed memory, potentially leading to arbitrary code execution within the kernel context.

Successful exploitation of this vulnerability allows a local attacker to execute code with kernel level privileges, resulting in full system compromise. Given the CVSS score of 7.0, the vulnerability is classified as High severity, as it enables lateral movement and persistent control over affected infrastructure. This poses a significant risk to data confidentiality, integrity, and operational availability in multi user environments.

Immediate Action: Update the Linux kernel to version 5.10.270, 5.15.221, 6.1.188, 6.6.157, or newer, as provided by your distribution vendor.

Proactive Monitoring: Review system audit logs for repeated UIO device registration failures or kernel panic events that may indicate exploitation attempts.

Compensating Controls: Restrict access to local device nodes and limit user capabilities to minimize the surface area for local privilege escalation attacks.

Public Exploit Available: No (exploit_available: false)

Organizations should prioritize the deployment of kernel security updates to all affected Linux systems. Because this vulnerability involves the kernel memory management subsystem, failure to patch leaves the system susceptible to local privilege escalation. System administrators should verify that their kernel packages are updated to the specified patched versions to mitigate this risk.