The flaw manifests as a double‑free in the Linux kernel’s TIPC module, specifically in the tipc_buf_append() routine. During the validation phase, tipc_msg_validate may reallocate a socket buffer, and if that reallocation is performed in a way that frees the original buffer, the error handling path later attempts to free the same buffer again. This repeated deallocation corrupts kernel memory, potentially leading to a crash or other memory corruption issues inherent to CWE‑415 and CWE‑763.

All Linux kernel builds that lack the commit introducing the fix are affected, which includes unpatched kernels shipped by any distribution. As a result, any system running a vulnerable kernel—whether Red Hat, Ubuntu, SUSE, or other vendors—remains at risk until the corrective patch is applied.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score of less than 1% suggests a very low current likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Inferred from the description, an attacker could construct a malicious TIPC packet to trigger tipc_msg_validate, potentially leading to a double‑free and kernel crash, though the exact exploitation path remains dependent on the victim’s TIPC configuration.