The vulnerability is a race condition in the espintcp_close() routine of the Linux kernel. When cancel_work_sync() is invoked, the associated espintcp_tx_work() work handler can still be scheduled by other kernel paths such as the Delayed ACK handler or ksoftirqd, allowing the worker to execute after the espintcp context is freed. This use‑after‑free can lead to a kernel crash or an attacker‑controlled execution environment if the freed memory is overwritten. The weakness is a classic race‑condition leading to dangling pointer dereference. The CVE description and audit‑based discovery confirm that the bug permits a local user or privileged process to trigger the fault by manipulating the espintcp state.

The issue appears in all Linux kernel releases that contain the espintcp implementation prior to the change referenced by commit 022ff7f. The affected code is part of the kernel’s kernel networking stack, specifically the espintcp subsystem. Vendor information is listed simply as Linux:Linux, indicating that any distribution shipping a version of the kernel before the patch is vulnerable.

The CVSS score of 7.8 classifies the flaw as high severity, indicating serious potential impact on system integrity. The EPSS score of less than 1% shows current evidence of exploit probability is very low; nevertheless, the normalized likelihood is non‑zero, suggesting that once shipped, the risk can rise if more attackers become aware. The vulnerability is not yet listed in CISA’s Known Exploited Vulnerabilities catalog, so no public exploits are known at present. A local privileged attacker who can execute code within the kernel can most likely trigger the race by initiating espintcp_close() while another thread schedules the work handler, potentially leading to a denial‑of‑service or privilege escalation scenario. The likely attack vector is local, but in environments where user processes have elevated privileges, the risk could extend to remote exploitation if the kernel service is exposed externally.