A race condition in the Linux kernel’s VRF (Virtual Routing and Forwarding) subsystem allows an RCU reader to observe a stale master device after a port is detached from a VRF. The kernel incorrectly assumes that a subsequent call to netdev_master_upper_dev_get_rcu() will return a VRF device, then dereferences its l3mdev operations without confirming the device’s validity. The flaw can lead to a NULL pointer dereference, causing a kernel crash and resulting in a denial of service. The described vulnerability is a classic NULL pointer dereference (CWE-820).

The issue affects any Linux kernel built from the mainline tree prior to the patch that adds RCU synchronization for VRF port removal. Vendors ship kernel versions that have not yet included the fix, and the vulnerability is present in the generic Linux kernel distribution as it stands in the Linux kernel source tree. Because the CVE references source code commits, the flaw is purely a kernel software bug and not tied to a specific distribution build or version range in the data.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is less than 1%, indicating a very low exploitation probability. However, the flaw requires the ability to remove a port from a VRF, which generally demands root or equivalent privilege on the local system. Therefore the likely attack vector is local, and the primary impact is a system crash that disrupts availability. The fix adds RCU synchronization to prevent the stale pointer scenario, and the vulnerability has not yet been observed in the wild, as evidenced by its absence from the CISA KEV catalog.