The vulnerability is a double‐free flaw in the Linux kernel netrom code, triggered during nr_route_frame(). Old packet data is freed without checking whether the neighbor’s ax25 pointer is NULL, so when the pointer is NULL the caller frees the same buffer again. This double‑free can corrupt kernel memory, potentially causing a crash or, in the worst case, allowing an attacker to execute arbitrary code at kernel level. The CVE description itself states only that memory corruption can result; the possibility of remote code execution is inferred, not explicitly asserted.

The bug exists in all Linux kernel releases that contain the original implementation of nr_route_frame, from kernel 2.6.12 (including its release candidates) through 6.19 rc6 and earlier. Any system running an unpatched kernel from this range is affected. The issue is specific to the netrom portion of the kernel; disabling that protocol eliminates the risk.

The CVSS score of 8.8 indicates high severity, while the EPSS value of less than 1% suggests exploitation is unlikely at present but not impossible. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an attacker to send malformed or specially crafted netrom network packets to the target system, or to have local privileges that can trigger the double‑free. Thus, remote or local compromise of the netrom stack is inferred as the primary path for exploitation.