In the Linux kernel’s network shaper, a netdev reference is taken before the device has been confirmed to be alive. The reference is later accessed in a Netlink callback under inadequate protection. This flaw can allow a use‑after‑free, which may corrupt memory and crash the kernel, potentially resulting in a denial of service or privilege escalation. The vulnerability originates from a missing liveness check when converting a reference to a locked netdev.

All Linux kernel versions that include the unpatched shaper code are affected. Because the code resides in core kernel files, any distribution shipping such a kernel version is impacted. The issue is not limited to a specific vendor or product line.

The CVSS score is not provided and EPSS data is unavailable, so a quantified severity cannot be stated. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local or privileged user sending crafted Netlink messages to trigger the problematic path. If exploited, the attacker could force a kernel crash or achieve code execution at ring 0. The risk is significant for exposed systems until the patch is applied.