The vulnerability is a use‑after‑free bug in the rlb_arp_recv() function of the bonding ALB driver, which occurs when a bonding interface is rapidly brought up or down while ARP packets are being processed. The driver frees the rx_hashtbl data structure during deinitialization, but an in‑flight receive handler may still reference it, producing a null pointer dereference detected by KASAN and causing a kernel panic. The crash indicates that an attacker could bring the system down at will by exercising the bond up/down cycle during ARP traffic.

This flaw exists in the Linux kernel bonding driver and affects all systems running a kernel version that does not yet include the patch that nulls recv_probe and synchronizes the network stack before deinitialization. Versions prior to the commit addressing the issue are vulnerable; any distribution using those kernels is impacted.

The CVSS score of 7.8 reflects a moderate‑to‑high severity, but the EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, suggesting a low likelihood of widespread exploitation. Based on the description, it is inferred that the attacker would need the ability to manipulate bond state transitions or generate ARP traffic on the target host, implying a local or privileged attack vector. The impact is denial of service through kernel crash, and code execution is not confirmed by the CVE description.