A missing RCU acquire barrier in the dev_map_redirect_multi() function allows a reader to access a partially-constructed hash bucket node on weakly-ordered architectures. The race between a concurrent writer using RCU primitives and the unsafe iterator can lead to inconsistent memory views, evading lock‑dependency checks and data‑race detectors and potentially corrupting kernel memory. The impact is an uncontrolled modification of kernel data structures, which may cause crashes, loss of data integrity, or, in the worst case, a local privilege escalation if an attacker can influence the iterated data.

Both the Linux and Linux kernel CNA vendors are affected. Any production kernel code that contains the dev_map_redirect_multi() path in the devmap hash branch and runs on ARM64 or POWER while using XDP to redirect packets is vulnerable. The exact version range is not enumerated, but the issue remains present until the patch that replaces the unsafe iterator and fixes the lock‑dep condition is included in upstream releases.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, giving no immediate indication of active exploitation. However, the CVSS score is not listed either, so the theoretical severity rests on the nature of a race condition that can corrupt kernel memory. If an attacker can trigger the sensitive XDP code path in a privileged context, the risk can be elevated to a high severity. The likely attack vector is a local kernel exploitation scenario where an attacker can control XDP programs or network traffic to the device that triggers the race. Remediation through a kernel patch mitigates the risk by restoring proper RCU ordering.