The Linux kernel bug allows a race between packet_release() and a NETDEV_UP event that re‑registers a socket into a fanout group's array, leaving a dangling pointer and an unreset counter. Because the socket is later accessed through this dangling reference, an attacker who can control or influence socket lifecycle can potentially execute arbitrary code with kernel privileges. The weakness is a classic use‑after‑free race condition. The description does not detail a confirmed exploitation path, but the nature of the flaw warrants concern for code execution and privilege escalation.

All Linux kernels versions prior to the fix commit (see references) are affected. The exact version range is not specified in the data, but any kernel build lacking the patch that sets po->num to zero inside packet_release() is vulnerable. This includes kernels that ship without the accompanying audit commit and those that have not incorporated the change from the provided Git commits.

The CVSS score is not supplied, but the bug involves a use‑after‑free with a potential for arbitrary code execution, indicating high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation yet. The likely attack vector would require local access to a process that can create and manipulate raw packet sockets and can trigger a NETDEV_UP event, such as by switching a network interface. The presence of the race window means that timely ordering of packet_release() and NETDEV_UP is critical for exploitation. If an attacker can orchestrate these events, they could hold an arbitrary kernel pointer and influence kernel memory.