The Linux kernel’s IBM emac network driver contains a use‑after‑free flaw that occurs when a device is removed. During the removal sequence, devm_register_netdev() defers the call to unregister_netdev() until the devres cleanup phase, which runs after the hardware teardown performed by emac_remove(). While the driver is still tearing down the hardware, the networking stack can process packets or invoke interrupt handlers that reference the now‑freed hardware resources, resulting in memory corruption or a kernel crash. This weakness is a classic use‑after‑free and is listed under CWE‑364 for use of freed memory.

The Emac driver is part of the Linux kernel. No specific kernel version numbers are provided in the CVE description, so any kernel build that still contains the original emac implementation prior to this patch is potentially affected. The vulnerability is identified through the Linux all kernel images that include the unpatched Emac driver.

The vulnerability is not listed in CISA KEV and the EPSS score is reported as less than 1%, indicating a very low likelihood of exploitation. The CV specify the privilege level required to trigger the removal of the Emac device; an attacker would need to cause or influence this removal to exploit the flaw. If successfully triggered, an attacker could force a kernel crash or denial of service. The impact is severe, but the low exploitation probability suggests a moderate overall risk. Prompt patching is recommended.