The bug is a race condition in the Linux network stack that allows a use‑after‑free of packet buffer structures when the number of transmit queues is changed rapidly while traffic is flowing. The flaw occurs when qdisc_reset() runs concurrently with the lockless dequeue path, freeing skbs that are still being accessed during packet processing. Such memory corruption can enable an attacker to execute arbitrary code in kernel mode or cause a system crash.

All Linux kernel builds that include lockless qdiscs and use qdisc_reset_all_tx_gt() for dynamic adjustment of transmit queue counts are affected. This encompasses standard desktop, server, and virtualized distributions. No specific kernel versions are listed, which means any kernel released prior to the patch is potentially vulnerable.

The CVSS score of 7.8 reflects high severity. EPSS is reported as less than 1 %, and the vulnerability is not in the CISA KEV catalog, indicating a low probability of widespread exploitation. Nonetheless, the flaw requires privileged control to modify queue numbers while traffic is present, a scenario common in virtualized environments or for local administrators. If exploited, the use‑after‑free can corrupt kernel memory and lead to privilege escalation or permanent denial of service.