A flaw in the Linux kernel’s packet buffer handling causes an orphaned reference to a zero-copy message buffer to be lost when a packet is carved. The missing reference count decrement leads to a premature free of the buffer descriptor, which in turn enables a local user to trigger a use‑after‑free. The proof‑of‑concept demonstrates that an unprivileged process can exploit the flaw to gain full root privileges on a machine running a default kernel configuration.

The vulnerability affects Linux kernel builds that implement the pskb_carve_inside_header and pskb_carve_inside_nonlinear functions, i.e., all kernels before the patch that fixes the missing zerocopy reference. It applies to any distribution running an unpatched Linux kernel.

The flaw is locally exploitable without special network access and has a clear, repeatable exploitation path. The lack of an EPSS score means there is no publicly available data on current exploitation rates, but the confirmed proof‑of‑concept and the nature of the use‑after‑free imply a high risk. The vulnerability is not listed in the CISA KEV catalog as of this analysis.