Technical impact
The vulnerability is a use‑after‑free in the Linux kernel networking stack. When a nexthop is removed from a group, remove_nh_grp_entry publishes a new group via RCU and immediately frees the per‑CPU statistics of the removed entry. Because the caller does not wait for the RCU grace period before freeing, an RCU reader that had accessed the old group can dereference the freed statistics, resulting in memory corruption. This weakness, classified as CWE‑825 and CWE‑416, could allow a malicious actor to exploit the issue via standard netlink interfaces, potentially escalating privileges to kernel level. The likely attack vector is netlink operations that modify routing tables.
Affected Systems
All Linux kernel releases that include the vulnerable remove_nh_grp_entry implementation are affected. The advisories reference the entire Linux kernel family, and no specific version range is provided. If your system is running a kernel prior to the commit that defers freeing per‑CPU statistics until after synchronize_net, the vulnerability remains present.
Risk and Exploitability
The CVSS score of 7.8 places this flaw in the high severity range. The EPSS score is approximately 0.00018 (less than 1%), and the vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread exploitation has been reported yet. However, use‑after‑free bugs in core networking code are known to be exploitable in the wild, and based on the description the attacker can exploit the issue via standard netlink interfaces, potentially escalating privileges. Administrators should treat the vulnerability as high risk and prioritize patching.
