The vulnerability is a use‑after‑free in the Linux kernel network driver. When a FarSync T‑series card is detached, the device structure is freed while related tasklets may still execute. If a tasklet accesses the freed structure, the kernel can dereference invalid memory, causing a crash, memory corruption or, potentially, arbitrary code execution. The weakness involves a race condition (CWE‑364) that results in a use‑after‑free (CWE‑416). The primary impact is kernel denial of service and the possibility of privilege escalation if the attacker can influence the contents of freed memory.

This issue affects the Linux operating system kernel. All kernel builds that include the net:wan:farsync module are potentially vulnerable. No specific version range is announced, so any kernel that has not yet incorporated the advisory commit is at risk.

The CVSS score of 8.8 indicates a high risk, while the EPSS score is < 1%. The vulnerability is not listed in CISA KEV, indicating no known public exploits yet. Based on the description, it is inferred that the attacker must trigger a race between card detachment and pending tasklets, which can be achieved by manipulating PCI hot‑plug or by sending specialized traffic to the driver. The combination of a race condition and a use‑after‑free in kernel space is considered high risk because it provides a low‑barrier local or remote code execution path after a triggered race. Given the potential for catastrophic kernel compromise, the overall risk is deemed high.