The bug resides in the IPv4 IGMP handling of the Linux kernel. When a network device is destroyed, the kernel iterates through its multicast group list and schedules each group for RCU reclamation without first removing the group from the multicast hash table. A reader can therefore access a group whose reference count has been decreased and that will be freed by an RCU callback, leading to a use‑after‑free latency that can corrupt kernel memory and, in the worst case, enable arbitrarily privileged code execution.

All Linux kernel builds that lack the fix introduced by commit 2ca18df1c2611f70eb3eb487e02ae85eb703b284—or any later commit that reverts the regression—are vulnerable. Because the vulnerability is tied to the kernel’s IGMP implementation, any distribution that ships a kernel version older than the one containing the fix is at risk.

The CVSS score of 7.8 indicates high severity, but the EPSS score below 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV and no public exploit has been documented. Exploitation would require the attacker to have privileged local access or to be able to initiate device destruction while an RCU reader is active, making the likely vector a local privilege escalation rather than a remote attack.