The Linux kernel contains a race where the function qdisc_reset_all_tx_gt() can execute concurrently with the dequeue path of lockless queuing disciplines. When the number of transmit queues is altered while traffic flows, qdisc_reset() may free packet buffers that are still in use by the dequeue routine, leading to a use‑after‑free of sk_buff structures. The mitigated code adds serialization via qdisc->seqlock and clears queue state to prevent further scheduling of empty queues. Identified bugs have produced KASAN reports such as slab-use-after-free in __qdisc_run, indicating observable memory corruption. The flaw can be triggered by repeatedly changing a NIC’s channel count using ethtool while high‑traffic tests such as iperf run, proving that the race condition is reproducible under realistic workloads.

All Linux kernel builds that include lockless queuing disciplines and employ qdisc_reset_all_tx_gt() for dynamic transmit queue adjustment are vulnerable. The Common Platform Enumeration set includes kernels from version 4.16 and the 7.0 release candidates, covering mainstream stable releases as well as development branches. In the absence of an explicit fix version list, any kernel prior to the patch that retains the vulnerable code paths is considered at risk.

The CVSS score of 7.8 categorises the problem as high severity. The EPSS score is reported as less than 1 %, signalling a low probability of widespread exploitation in the wild. The vulnerability is not present in the CISA KEV catalogue. Exploitation would likely require the ability to change NIC transmit queue counts while traffic is active, a scenario normally available to local attackers or privileged processes. The resulting use‑after‑free could corrupt kernel memory, potentially leading to a system crash or, if an attacker gains control of the freed memory, privilege escalation or arbitrary code execution.