This vulnerability in the Linux kernel PSI subsystem was caused by a race condition between psi_schedule_rtpoll_work() and psi_trigger_destroy() functions manipulating the rtpoll_timer without proper synchronization. The race could result in the timer firing after the associated cgroup memory was freed, causing use-after-free behavior. Previous attempts to fix the issue by deleting the timer synchronously introduced other races during trigger creation. The final resolution was to bind the timer to the cgroup's lifetime and shut it down synchronously in psi_cgroup_free(), ensuring no timer can be armed after the group is freed.

The vulnerability could lead to use-after-free conditions where the timer callback runs on freed memory, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to kernel stability and potential denial of service rather than direct privilege escalation or data leakage based on the provided information.

A fix has been implemented in the Linux kernel that binds the rtpoll_timer to the cgroup's lifetime and shuts it down synchronously in psi_cgroup_free(). Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed versions and apply updates accordingly.