The vulnerability arises from the use of an unsafe RCU iterator in the dev_map_redirect_multi() routine that handles XDP packet redirection on the SKB path. The DEVMAP_HASH branch currently iterates hash buckets using hlist_for_each_entry_safe(), which performs plain pointer dereferences without the required rcu_dereference() barrier. On weakly‑ordered architectures such as ARM64 and POWER, a reader can see a partially constructed node while a concurrent writer is updating the list, potentially corrupting kernel data structures and causing crashes or loss of data integrity. This flaw represents a race condition coupled with NULL dereference possibilities (CWE‑362, CWE‑476, CWE‑821).

All Linux kernel builds that contain the dev_map_redirect_multi() function with the DEVMAP_HASH branch in SKB XDP handling are affected if they run on ARM64 or POWER architectures before the RCU‑safe iterator patch is applied. The source code modification is present in all versions with the described code until the fix from upstream was shipped; the exact range of affected kernels is not specified, so any kernel older than the patched release that includes the vulnerable branch is potentially impacted, regardless of distribution or patch level.

The CVSS score of 7.8 reflects high severity, while the EPSS score of less than 1% and the lack of inclusion in the CISA KEV catalog indicate that no known active exploitation exists. Based on the description, a local attacker would need the ability to influence XDP execution or produce high‑volume crafted packets to trigger the race. The attack surface is limited to systems with XDP enabled, and the exploit would likely require privileged or kernel‑level code paths; however, it could result in arbitrary kernel memory corruption.