The vulnerability arises when the airoha driver frees a metadata destination object directly with kfree(), bypassing the RCU grace period. A non‑refcounted pointer from a network socket buffer to this object must stay valid until all RCU readers finish. If the driver unwires the object while a socket is still referencing it, the memory can be reused before the reference is cleared, resulting in a use‑after‑free condition. This can lead to arbitrary code execution, system crash, or denial of service.

The flaw exists in the Linux kernel’s airoha network driver. Any Linux distribution shipping a kernel version that includes the airoha module release range is not specified in the data, but the issue was addressed in the kernel’s airoha driver code as shown in the referenced commits.

The behavior requires that the attacker can send crafted packets to the affected system so the driver tears down the metadata destination while the packet is still being processed. Because the flaw is a classic use‑after‑free, it is a high severity memory corruption vulnerability; however, EPSS data is not available and it is not listed in CISA KEV, so there is no known active exploitation yet. The likelihood of exploitation depends on an attacker’s ability to target the vulnerable driver and to maintain references to the freed object long enough for RCU read‑side protection to mis‑apply.