A use‑after‑free bug in the Linux bonding network driver allows the same socket buffer to be freed twice when a bonded interface transmits packets while a slave is concurrently enslaved or released. The double free triggers a kernel crash, which can bring the whole system down. This crash occurs in privileged kernel code, so a successful exploitation could also provide a foothold for privilege escalation if the attacker is able to execute the race condition.

The flaw is present in any Linux kernel that includes the bond_xmit_broadcast() routine without the bug fix. No specific kernel versions are listed in the advisory, so any unpatched instance of the Linux kernel is potentially vulnerable. The affected product is the Linux Kernel itself.

The CVSS score of 7.0 reflects a moderate‑to‑high severity due to the possibility of a kernel panic. An attacker would need privileged access to reconfigure bonded interfaces and generate traffic that triggers the race condition. Because the attack vector is local and requires configuration changes, widespread exploitation is unlikely, but the impact of a successful crash is severe. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog.