The vulnerability resides in the MediaTek Ethernet SoC driver in the Linux kernel, where a metadata destination object is freed directly with kfree() instead of through the RCU‑safe reference counting path. This allows an attacker to send crafted packets that trigger the driver to tear down the metadata while network buffers still hold non‑refcounted pointers to it, causing a use‑after‑free. If exploited, an attacker could corrupt kernel memory or cause a crash, potentially escalating privileges or disrupting service. The weakness is a classic CWE‑416 use‑after‑free.

Vendors: Linux; Product: Linux Kernel. The flaw affects any kernel build that includes the MediaTek mtk_eth_soc driver prior to the patch that replaces metadata_dst_free() with dst_release(). No specific version numbers are provided, so all versions containing the legacy implementation are susceptible.

The exact CVSS score is not disclosed, and the EPSS metric is unavailable, so an objective quantitative risk assessment cannot be provided. However, the flaw is a low‑level kernel bug that can be triggered by network traffic, implying a remote attack surface. No existence is reported in the CISA KEV catalog, but frequently exploited. Inferred attack vector is remote network traffic sent to the affected Ethernet interface; no local privileges are explicitly required beyond NIC access.