During linkwatch processing the reference count for a network device is released too early by a call to __dev_put(). When the device reference drops to one, the workqueue later frees the device object. A subsequent call to netdev_unlock_ops() then dereferences a pointer to the freed object, causing a kernel memory corruption event. The corruption manifests as a KASAN use‑after‑free failure and may trigger a kernel panic or enable controlled memory corruption for privilege escalation.

All Linux kernel distributions that ship the affected development releases are impacted. The flaw exists in kernel series 6.15 from rc1 through rc7 and in 6.19 from rc1 through rc8, covering a wide range of vendors and distributions that distribute these kernels.

The vulnerability has a high CVSS score of 7.8, indicating a severe risk if successfully exploited. The documented exploit probability is very low at present, and the flaw is not listed in the CISA KEV catalog. A local or privileged attacker who can create and delete network interfaces—such as by manipulating tun devices—could trigger the fault, while a remote attacker would need additional privileges. Because the race window is narrow and the attack requires kernel execution, the overall threat remains moderate to low, but the potential kernel crash remains a significant concern.