The vulnerability arises from the kernel's handling of knotes during the fork process. Specifically, if a knote with a timer-based filter fires while the kernel is copying knotes, it can be enqueued on the kqueue's active list before the copy completes. The copy routine does not account for this scenario and may enqueue the new knote a second time, corrupting the active list. Additionally, the copy routine fails to hold the necessary locks when reading knote state, allowing race conditions. This use-after-free vulnerability can be triggered by an unprivileged local user, potentially leading to privilege escalation.

An unprivileged local attacker can exploit this vulnerability to cause a use-after-free condition in the kernel, which may result in privilege escalation. The corruption of the kqueue's active list and race conditions can compromise kernel stability and security, potentially allowing the attacker to gain higher privileges or execute arbitrary code in kernel context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict unprivileged local access to affected systems and monitor for suspicious local activity related to kqueue usage. Avoid running untrusted code locally that could trigger this vulnerability.