The flaw arises because the Linux kernel frees the net->ipv4.sysctl_local_reserved_ports structure before all threads that may use it have stopped, leading to a use‑after‑free vulnerability (CWE‑825). This can cause the kernel to dereference invalid memory, resulting in a crash, data corruption, or a reboot that disrupts all services on the affected host.

All Linux kernel builds that do not include the fixed commit are impacted. The issue is present in the kernel source tree before the patch that removes the premature free, so every kernel older than the released fix is vulnerable.

The CVSS score of 7.8 reflects a high severity impact. The EPSS score is <1%, suggesting that exploitation is unlikely at present, and it is not yet listed in the CISA KEV catalog. Based on the description, the vulnerability is triggered during network namespace exit or system shutdown, where the kernel still processes sysctl accesses such as /proc/sys/net/ipv4/ip_local_reserved_ports. An attacker who can induce a namespace teardown while a privileged process is writing to that sysctl may be able to provoke a kernel crash and cause a denial of service. The exact remote attack vector is not provided, so the risk is inferred from the crash‑prone use‑after‑free condition.