The vulnerability is a race condition in the Linux kernel network shaper subsystem. When a Netlink SET operation is prepared, a reference to a network device is taken without acquiring the necessary lock immediately. If the device is unregistered before the lock is obtained, a hierarchy structure may be allocated after a system flush has already completed, leading to a leaked memory region. This leak can exhaust kernel resources and destabilize the system. The weakness is classified as a race condition.

Any Linux kernel version that contains the net: shaper subsystem before the patch that locks the network device during Netlink preparation is affected. The generic kernel builds are listed without a specific version range, indicating that earlier releases may be vulnerable.

The strength of the vulnerability is reflected in a CVSS score of 5.5, indicating moderate severity. The likelihood of exploitation is low. The vulnerability is not cataloged in known exploited vulnerability lists. Exploitation would most likely require local or privileged access to trigger the specific Netlink operations while a device is being unregistered. Success would result primarily in memory leaks and potential eventual system instability rather than remote code execution or privilege escalation.