A race condition exists in the Linux kernel’s XDP devmap handling on PREEMPT_RT builds. Concurrent access to the per‑CPU xdp_dev_bulk_queue allows multiple preemptible tasks on the same CPU to interleave bq_enqueue() and __dev_flush(), producing double‑free, use‑after‑free, and corruption of the queue structure. These conditions can corrupt kernel memory and cause system crashes, leading to denial of service.

All Linux kernel installations that are compiled with PREEMPT_RT support. The flaw is present in any kernel that includes the vulnerable version of the XDP devmap code; it is unclear if all distributions have incorporated the patch.

The CVSS score of 7 indicates a high severity, while the EPSS score of less than 1% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a local attacker with the ability to trigger concurrent XDP traffic on the same CPU. Based on the description, it is inferred that such an attacker would need to load or manipulate XDP programs to cause the race condition, which is not a typical remote threat scenario.