In the Linux kernel network shaper, the VALID flag on an XArray entry is set and cleared without atomicity, creating a race between a reader that observes a VALID mark and a writer that replaces the entry. If a reader continues after being interrupted and then fetches a different pointer that was not originally associated with the VALID stamp, the rollback routine may free memory that has already been reallocated. This use‑after‑free can corrupt kernel memory. The description explicitly notes that the biggest consequence is a UAF, which is the primary impact.

All Linux kernel releases that contain the shaper subsystem before the commit that introduces an explicit atomic VALID field are affected. The referenced commits (2417df5e7bb4184b9d3a2988036bf2c46e594545, 96ea960dd40fd55302e0fd755176f26a95e6a50c, b8d7519352ba8c6df83259295d4a3bad093cae90) provide the fix, so kernel versions prior to those changes are vulnerable. This includes all standard and distribution kernels that have not applied the patch.

The CVSS score of 7.8 indicates a high severity. The EPSS score of less than 1% implies an extremely low measured probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker able to trigger the race condition, likely by manipulating traffic shaping operations or inducing specific timing scenarios. The combination of a race condition, non‑atomic flag handling, and reliance on RCU suggests that the window for successful exploitation is narrow and requires precise conditions, which aligns with the low EPSS.