This weakness occurs in the Cadence macb driver of the Linux kernel where the PTP clock object is freed after the interface is closed but can still be accessed via the ethtool get_ts_info ioctl. The kernel then reads freed memory, leading to a use‑after‑free condition. If triggered, the fault can corrupt kernel memory or cause a crash, potentially allowing an attacker with sufficient privileges to execute arbitrary code at ring‑0.

All installations running the Linux kernel that include the Cadence macb network driver before the patch becomes available. The specific affected kernel versions are not enumerated in the advisory, but any kernel that registers the PTP clock on interface open and does not guard the get_ts_info call while the interface exists is vulnerable.

The CVSS score is not supplied, but a use‑after‑free in kernel code typically denotes high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local: an attacker who can run ethtool on a macb interface—in practice an end user or a privileged user—can trigger the fault. While remote exploitation is unlikely without local access, compromised systems could experience denial of service or escalation of privileges. The overall risk is considered high for systems running unpatched kernels.