The IBM Emac Ethernet driver in the Linux kernel creates a use‑after‑free condition when a device is removed. During removal the driver defers the unregistration of the network device until the devres cleanup phase, which occurs after the hardware teardown has already happened. This gap can allow the kernel’s networking stack to process packets or invoke interrupt handlers that reference hardware resources that have been freed, leading to memory corruption or a system crash. The flaw is a classic use‑after‑free vulnerability and can be exploited to destabilize the system.

The vulnerability affects the Emac driver that is part of the Linux kernel. No specific kernel version numbers are listed, so any kernel containing the old Emac implementation is potentially affected.

The vulnerability lacks a CVSS score and its EPSS score is not available, and it is not listed in CISA been reported, because the flaw can cause a kernel crash, the theoretical impact is severe. The likely attack vector is local; an attacker would need to trigger a device removal or otherwise manipulate the driver interface, which generally requires privileged access. The absence of exploitation data suggests that the risk is moderate but the potential for denial of service warrants timely remediation.