A use‑after‑free bug in the Linux bonding driver allows the same socket buffer to be freed twice when a bonded interface transmits packets while a slave is concurrently reconfigured. The double free triggers a kernel panic that can bring the entire system down. This occurs in privileged kernel code; the description indicates a double free in the bonding module and KASAN reports a kernel crash. Based on the description, it is inferred that the flaw runs in kernel space and an attacker would need to trigger the race condition from a privileged or local context.

The flaw is present in any Linux kernel that includes the bond_xmit_broadcast() routine without the recent patch, i.e., all unpatched kernels of the Linux operating system. Specific kernel releases are not listed in the advisory, so any instance of the Linux kernel running the bond module before the fix is potentially vulnerable.

The CVSS score of 7.8 reflects moderate‑to‑high severity due to the potential for a kernel panic. Based on the description, it is inferred that the attack vector is local and requires privileged access to reconfigure bonded interfaces to induce the race condition. Because the exploit depends on concurrent changes to slave configuration, widespread exploitation is unlikely, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog.