The Linux kernel’s hisilicon/sec2 crypto driver was found to free a request‐level memory block (req) before the packet transmission routine finished using it, creating a use‑after‑free condition. This flaw can lead to memory corruption, process crashes, or, if an attacker can trigger the scenario reliably, arbitrary code execution. The defect maps to CWE‑416, a classic use‑after‑free weakness.

The vulnerability affects the Linux kernel, specifically the crypto driver for Hisilicon sec2 devices. No specific kernel versions are listed, so all kernel releases that have not incorporated the fix may be vulnerable.

With no CVSS score or EPSS data available, the severity is assessed as moderate to high, as the flaw could cause denial of service or compromise in high‑traffic environments. The fix was not listed in CISA’s KEV catalog, indicating no current exploitation reports. The most likely attack vector is through network traffic to the system: an adversary could generate heavy packet loads to trigger the race condition, though successful exploitation would require precise timing and is therefore considered less straightforward than a typical remote code execution vulnerability.