A use‑after‑free flaw exists in the kernel paths that gather information about offloaded BPF maps or programs. When the underlying network namespace is being torn down, the kernel may increment a reference count on a zeroed object, causing a memory fault. If an attacker can trigger the code path, the fault could lead to a kernel panic or, in some circumstances, arbitrary code execution. The impact is therefore a potential denial‑of‑service or escalation of privileges, depending on exploit conditions.

All Linux kernel distributions that shipped a kernel version prior to the application of the fix referenced in the advisory. The vendor list includes the generic Linux kernel; no specific version numbers are supplied, so any kernel that still contains the vulnerable paths is affected.

The vulnerability is not listed by CISA as a Known Exploited Vulnerability and no EPSS score is available. The absence of CVSS data means the precise severity cannot be quantified here, but use‑after‑free flaws in kernel code are typically considered high risk. Exploitation would likely require local or privileged access and an ability to execute BPF programs that query information about offloaded maps or programs in a context where the network namespace may be tearing down. The entry does not appear to offer a publicly documented workaround, so the only effective defense is applying the fixed kernel.