A reader in the Linux L2TP code can acquire a pointer to a session whose reference count has reached zero, then attempt to increment the count with a plain refcount_inc(). Because this operation is not guarded against zero, the function can inadvertently succeed on a freed object, causing a use‑after‑free. The resulting memory corruption can lead to a crash or a kernel privilege escalation. The weakness is a classic use‑after‑free coupled with a race condition. The likely attack vector is local, as an attacker would need to trigger concurrent L2TP session lookup and deletion on the same machine. The CVE description explicitly states that a reader within an rcu_read_lock_bh() context can be preempted between the string comparison and the refcount_inc(), leading to a use‑after‑free.

The vulnerability affects the Linux kernel in any distribution that includes the L2TP implementation without the described fix. Since vendor naming is generic ("Linux:Linux"), the issue applies broadly to current and older kernels that have not yet incorporated the patch for this bug, regardless of distribution. Affected systems are those running kernel versions prior to the inclusion of the patch for this bug, regardless of distribution.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of < 1% shows that current medium‑risk probability of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, meaning it is not known to be actively exploited in the wild. However, because the flaw allows a use‑after‑free that can lead to arbitrary code execution at kernel level, the potential impact remains significant for local attackers. The problem is mitigated by the fact that the race requires a specific timing window and careful interaction with L2TP, but an attacker could potentially craft such conditions. Given these characteristics, the overall risk is high for affected hosts.