The vulnerability occurs in the hns3 network driver of the Linux kernel. During ring parameter configuration, a temporary copy of the ring structure is created for rollback. The tx_spare pointer in the original ring remains pointing to the old backup memory after a failure during allocation. Later, when the error cleanup path attempts to free newly allocated rings, this stale pointer is mistakenly freed as a new buffer, causing a double free. This results in memory corruption that can be leveraged by a local attacker to achieve arbitrary code execution or crash the kernel, leading to a denial of service.

All Linux kernel releases that include the hns3 driver are potentially affected. The CPE entry indicates the Linux kernel, and no specific version ranges are provided, so any kernel containing the hns3 driver before the fix is at risk until patched.

The double‑free flaw can destabilize the kernel and provide a vector for privilege escalation to the attacker. The CVSS score and EPSS metric are not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploit. Nevertheless, because the flaw occurs at privileged level, the risk is high for systems that enable the hns3 driver. The attack vector is local; an attacker with access to the affected system or the ability to influence driver configuration needs to trigger the failing path.