A use‑after‑free flaw in the Linux kernel’s rtl8150 USB Ethernet driver causes the driver’s transmission routine to read the packet length from a socket buffer after the buffer has already been freed by the USB completion callback. This leads to an invalid kernel memory read that can trigger a kernel panic and crash the system. The bug can be exercised simply by sending traffic through the affected USB Ethernet adapter; no additional privileges beyond control of that interface are required.

The vulnerability impacts all Linux kernel releases that contain the rtl8150 driver before the merge of the fix. There is no explicit version range provided; thus any kernel that has not incorporated the listed commits is affected, regardless of the mainstream or distribution‑specific kernel series.

The CVSS score is not specified and the EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local physical or logical control of the USB device, allowing an attacker to transmit crafted packets that exercise the bug. While no publicly available exploit exists, the risk is moderate to high: a successful trigger results in a system crash that requires a reboot to recover, and the probability of exploitation is low due to the lack of widespread public exploits.