The vulnerability resides in the Linux kernel’s QRTR (Qualcomm Resource Tracking) driver, where the driver removal routine can concurrently be triggered by packet reception. If a packet arrives after the workqueue is destroyed but before the socket is released, the callback that attempts to queue work dereferences a freed structure. This use‑after‑free can corrupt kernel memory, potentially leading to a crash or, in the worst case, arbitrary code execution from kernel space. The underlying weakness is a classic use‑after‑free bug (CWE‑416).

All Linux kernel builds that include the QRTR driver are affected until the patch that preserves the original sk_data_ready callback in qrtr_ns_init() is applied. The exact affected versions are not specified, so any distribution version prior to the commit authorship (0f313eb6a8f6dffa491373cf3afab979fa1c02f4 and related commits) is potentially vulnerable.

The CVSS score is not provided, but the absence of the KEV listing suggests no confirmed exploit, and EPSS is not available. Nonetheless, the vulnerability requires an attacker to send packets to a device that uses the QRTR interface while the driver is being removed. If the attacker has local or remote access to that interface, the memory corruption could be triggered. The risk is therefore moderate; it does not affect remote systems purely via network traffic unless the QRTR interface is exposed.