A Use‑After‑Free occurs when the virtio_net driver runs with napi_tx disabled and the IFF_XMIT_DST_RELEASE flag is cleared while transmitted packets remain in the virtio ring; destroying the network namespace frees the underlying dst_ops structure, causing a subsequent packet transmission to dereference a freed pointer and trigger a kernel paging request. The flaw is a classic Use‑After‑Free (CWE‑416) that results in an unconditional crash and denial of service rather than arbitrary code execution. Based on the description, it is inferred that the attack vector requires local interaction with network namespaces or netlink configuration.

The vulnerability affects the Linux kernel, specifically the virtio_net driver module. Version information is not enumerated in the advisory; however, the issue was confirmed against a 7.0.0‑rc1 kernel instance and is likely present in all kernels that have not applied the commit that introduces skb_dst_drop in start_xmit.

The CVSS score is 7.8 and the EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local and demands privileged capabilities. Exploitation requires a local user with the ability to create and delete network namespaces or manipulate netlink qdisc settings, which effectively grants root or at least kernel‑module capability. Given that the impact is a forced kernel panic, the risk remains high for affected systems, but the vector is limited to privileged locals. In practice, operators should assess whether they run untrusted software with netns or tc access before applying this fix.