In the Linux kernel's Freescale QMan (qbman) driver, a race condition exists when the QMAN_FQ_FLAG_DYNAMIC_FQID flag is enabled. If one thread destroys a queue while another concurrently creates a new queue, the freed FQID can be reallocated before the corresponding table entry is cleared, causing the WARN_ON check to trigger and corrupting the internal fq_table. This race condition (CWE‑362) and the improper memory ordering (CWE‑367) can lead to kernel instability and a denial of service.

Linux kernel 7.0 release candidates 1 through 4 (rc1–rc4) that include the qbman driver for queue management are potentially affected. Any kernel build containing the buggy qman_destroy_fq implementation before the fix could be vulnerable.

The CVSS score of 4.7 indicates low severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require local or privileged code that can simultaneously destroy and create queues. No public exploit is known.