In the Linux kernel, a prior implementation incorrectly attempted to free a network structure with rio_free_net() even when the net object had not been registered with rio_add_net(), which could leave a dangling pointer that may be dereferenced later. The patch replaces the call with kfree() and sets the mport->net pointer to NULL, eliminating the risk of use‑after‑free or memory corruption. The flaw could potentially lead to kernel instability that may be exploited to crash the system, but no direct code‑execution path is described in the provided information.

Vulnerable Linux kernel images that include the rapidio driver prior to the commit that introduces the corrected free logic are affected. All distributions using the stock kernel are potentially impacted if they have not applied the rapidio patch; the exact release dates are not specified, so any kernel older than the commit that referenced this fix is at risk.

Because the exploit would require triggering an idtab allocation failure in the rapidio driver and then accessing the freed net structure, the attack vector is likely local and confined to devices that use the rapidio backend. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits. Therefore, the overall risk is considered moderate, with a low likelihood of real‑world exploitation under normal operating conditions.