The flaw originates from a use‑after‑free vulnerability within the net/ena driver’s PHC timestamp path. A device’s active flag and DMA pointer were checked and cached without holding the protecting spinlock. If the PHC device is destroyed concurrently, the cached pointer can become NULL and the subsequent dereference corrupts kernel memory, potentially crashing the system or allowing an attacker to execute arbitrary code.

All Linux kernel installations that contain the ena network driver are affected. The vulnerability is a property of the kernel kernel itself and applies to any distribution or vendor that has not incorporated the recent commit that moves the active check and pointer read inside the spinlock region.

The CVSS score is not published and the EPSS score is currently unavailable, so the precise exploitation likelihood cannot be quantified. The likely attack vector is that an attacker with local or privileged access could trigger destruction of the ENA PHC device while a timestamp read occurs, causing the use‑after‑free. The flaw is listed as a high‑severity kernel device driver issue and is not included in CISA’s KEV catalog, indicating no known active exploitation at this time, yet the memory corruption potential warrants prompt remediation.