A race condition exists in the Linux netdevsim driver where simultaneous addition and deletion of BPF programs can corrupt the bpf_bound_progs list. When nsim_bpf_create_prog performs list_add_tail while nsim_bpf_destroy_prog performs list_del concurrently, the list data structure may become corrupted, triggering a kernel BUG and immediate system crash. The denial of service arises from a kernel crash, causing all system processes to fail until a reboot. This vulnerability is classified as CWE‑362, a race condition.

The flaw affects the Linux kernel up to 6.19 rc6 and any derivative kernels that include the netdevsim driver before the patch is merged. All vendors shipping these kernel releases or earlier include the vulnerability. The issue is specific to the netdevsim module, so any Linux installation that loads this module and enables BPF‑bound program creation or deletion is potentially impacted.

The CVSS v3.1 score of 4.7 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, further indicating limited active exploitation. Exploitation requires privileged access to load or unload BPF programs on the netdevsim interface, implying a local or privileged attacker. The lack of a public exploit reduces confidence in widespread attacks, but the crash could be exploited by an attacker who can inject crafted BPF programs or trigger the race during normal operation.