The vulnerability is a use‑after‑free in the Linux kernel networking stack. When a nexthop is removed from a group, remove_nh_grp_entry publishes a new group via RCU and immediately frees the per‑CPU statistics of the removed entry. Because the caller does not wait for the RCU grace period before freeing, an RCU reader that had accessed the old group can dereference the freed statistics, resulting in memory corruption. This weakness, classified as CWE‑825, can allow an attacker who can trigger a nexthop removal to execute arbitrary code with kernel privileges. Based on the description, the likely attack vector is netlink operations that modify routing tables.

All Linux kernel releases that include the vulnerable remove_nh_grp_entry implementation are affected. The advisories reference the entire Linux kernel family, and no specific version range is provided. If your system is running a kernel prior to the commit that defers freeing per‑CPU statistics until after synchronize_net, the vulnerability remains present.

The CVSS score of 7.0 places this flaw in the high severity range. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread exploitation has been reported yet. However, use‑after‑free bugs in core networking code are known to be exploitable in the wild, and based on the description the attacker can exploit the issue via standard netlink interfaces, potentially escalating privileges. Administrators should treat the vulnerability as high risk and prioritize patching.