The vulnerability is caused by a violation of RCU (Read‑Copy‑Update) rules in the Linux kernel’s handling of /proc/net/ptype. The routine ptype_seq_show() obtains a device pointer while holding rcu_read_lock() without a memory barrier, and concurrent writers can delete the packet_type structure and clear its device pointer without waiting for an RCU grace period. This race can lead to a kernel stall or crash because the reader may access freed or invalid data, compromising system availability.

All Linux kernel builds that do not contain the patch that adds proper RCU protection to /proc/net/ptype are affected. That includes all kernels before the commit that introduced the ptype_iter_state struct and the READ_ONCE() safeguards. The issue touches the core networking subsystem, so any system running an unpatched kernel is potentially vulnerable.

The CVSS score of 7.0 indicates moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation in the wild. An attacker would need to induce a race condition against the packet_type list, which typically requires local or privileged access to manipulate /proc/net/ptype or to load drivers that modify packet_type entries. The most likely attack vector is a local privilege escalation or a malicious kernel module that performs concurrent modifications, though a remote attacker might trigger it through network traffic that causes concurrent writes if such an interface is exposed.