A use‑after‑free bug occurs in the Linux kernel’s macb network driver when a PTP clock is destroyed on interface close but can still be queried via an ethtool get_ts_info call while the interface remains in the kernel. The kernel accessor reads the freed PTP clock structure, exposing undefined memory and potentially corrupting kernel data. This flaw is a classic memory management error that could allow an attacker to read sensitive kernel memory or cause a kernel panic, which might lead to privilege escalation or denial of service if exploited from a privileged process.

The issue affects the macb Ethernet driver in the Linux kernel, particularly on platforms that use Cadence’s macb implementation. Any Linux kernel where this driver is present and the interface is opened and closed without applying the patch is susceptible. The vulnerability can be present in any kernel version prior to the fix, including those in the 6.1 series.

The flaw is a local kernel vulnerability with a CVSS score of 7.8 that requires the attacker to interact with a network interface that has the macb driver active. Exploitation would involve issuing a specific ethtool ioctl call after the interface has been closed, triggering the use‑after‑free. The EPSS score is listed as less than 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. The severity of this bug aligns with CWE‑825 (Memory Management Errors), and while it could lead to a system crash or privilege escalation, the need for an active interface and a privilege level that can perform the ioctl call limits the attack surface.