A use‑after‑free (CWE‑416) flaw in the rtl8150 USB Ethernet driver causes the transmit routine to read the length field of a socket buffer after the buffer has already been freed by the USB completion callback, leading to a kernel panic and denial of service. This use‑after‑free also involves a dangling pointer scenario that may be associated with CWE‑364. The fix caches skb->len before submitting the URB and uses that cached value when updating tx_bytes.

All Linux kernels that include the rtl8150 driver before the recent fix commits are vulnerable. This includes any upstream or distribution kernel that has not yet incorporated the authors’ changes, regardless of kernel series. The vulnerability is present whenever the rtl8150 driver code is compiled into the kernel.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local physical or logical control of the USB Ethernet adapter to send traffic that exercises the bug; based on the description, it is inferred that no publicly available exploit code is documented. Successful exploitation results in a system crash that requires a reboot, placing the risk at high in environments where the device is in use.