A use‑after‑free condition exists in the xen‑netback driver of the Linux kernel. When a queue is torn down after an error connecting to a guest frontend—often caused by malformed Xenstore data—the statistics data is freed without proper RCU synchronization. If the data is still being read via sysfs at that moment, the driver may access freed or re‑used memory. This flaw can lead to information disclosure, memory corruption, or a kernel panic, and could be exploited to execute arbitrary code if an attacker controls the memory region being freed.

All Linux kernel releases that include the xen‑netback driver prior to the commit that introduced the fix are affected. The CNA lists the product simply as "Linux:Linux" with a generic CPE for the kernel, and no specific version numbers are provided. Any kernel running before the commit that introduced the fix is vulnerable.

Based on the description, it is inferred that a local attacker with access to the guest environment can trigger the fault by causing a connection error and, while the kernel is in the teardown phase, read statistics via sysfs. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, indicating no known public exploitation at the time of this analysis. The risk is significant enough that the flaw should be corrected promptly, but it requires local or privileged access to exploit.