The vulnerability is a use‑after‑free bug in the Linux macb network driver that arises when the PCI glue driver is removed while the device is still in a runtime resume state. During the removal sequence the driver accesses clock objects that have already been freed, causing a kernel fault as shown by the KASAN report. Because this fault occurs in privileged kernel mode, the primary consequence is a kernel crash and system reboot, which effectively denies service to all users of the affected system.

All Linux kernel versions prior to the inclusion of the kernel commit that fixes this bug, including the 6.1.164 release and earlier, are vulnerable. The flaw manifests on systems that load the macb driver for PCI network hardware, such as virtual QEMU instances or hardware boards that use the MACB chipset. Any installation that has not yet applied the commit d82d5303c4c5 or a later kernel version that incorporates the same fix is susceptible.

The CVSS score of 7.8 indicates high severity, but the EPSS score of < 1% indicates a low probability of exploitation. The vulnerability is not found in CISA's KEV catalog, implying limited known exploitation. Exploitation requires local or privileged kernel access to unload the macb module or trigger a runtime resume event, after which the freed clock objects can be accessed by the driver code. Attacker privilege is needed to provoke the sequence, so the attack vector is primarily local with kernel-level permissions. The risk remains significant for systems running unpatched kernels where such privileged access is possible.