In the Linux kernel, the networking shaper component fails to properly verify that a net device remains registered before accessing it in a later phase of a Netlink callback. The code takes a reference during the preparation step and later performs a read under a lock or RCU protection, but the transition between reference acquisition and protected use lacks a liveness check. This race condition can lead to a use‑after‑free if the device is unregistered while the callback is still executing. The vulnerability combines a concurrent access race (CWE‑662) with a use‑after‑free scenario (CWE‑825). An attacker that can trigger Netlink operations could cause kernel memory corruption, a crash, or a denial of service.

The flaw affects all Linux kernel implementations. The known vendor entry lists the generic Linux kernel, and no specific affected version is supplied in the CNA data, implying that older kernel releases lacking the patch are susceptible.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1% suggests the exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog. An attacker would likely need local or privileged access to trigger the Netlink operation that exercises the buggy path; the attack vector is therefore inferred to be local via Netlink. While fixed protections reduce the risk of complete code execution, the race condition could still lead to kernel crashes and service disruption.