This bug in the Linux kernel xen networking subsystem causes the multicast address list to be freed before all transmit and receive operations have concluded. The unsynchronized deallocation can lead to a kernel panic or other OS crash, resulting in loss of networking connectivity or a full system reboot. The weakness arises from improper ordering of resource cleanup, classified as a use‑after‑free scenario.

All Linux kernel implementations that include the xen-netback driver and have not yet applied the patch to defer xenvif_mcast_addr_list_free() until after TX/RX processing fully terminates. The flaw applies to any kernel running the Xen backend drivers before the fix that moves the free call out of the disconnect path.

No CVSS score or EPSS data is published for this item, and it is not listed in CISA’s KEV catalog. The vulnerability is an order‑of‑operations violation during memory cleanup; it can be triggered by a local or privilege‑escalated process that initiates a xen-netback disconnect. The attack surface appears to be limited to systems where the Xen backend driver is loaded; no external network‑exposed trigger is specified. Consequently, the risk is considered moderate because exploitation requires a privileged context on the host, but the impact of a crash is severe.