Netpoll is the networking polling interface used by kernel network drivers. A use‑after‑free occurs when the driver enters its shutdown path concurrently with a pending TX worker. The cleanup routine frees the netpoll device information structure (npinfo) while the worker still references it, leading KASAN to report a slab‑use‑after‑free. The freed memory may be reused, causing the worker to read or write corrupted data, which can result in a kernel crash and loss of system availability. This weakness is classified as CWE‑825.

The flaw exists in the Linux kernel itself, affecting any distribution or custom kernel build that has not incorporated the commit that implements disable_delayed_work_sync in __netpoll_cleanup. The vulnerability applies to all kernel versions prior to the hardening commit referenced in the advisory, which is available in the mainline repository and can be applied to any kernel using the commit hash 45f1458a85017a023f138b22ac5c76abd477db42 or later. No specific vendor version list is provided, so any Linux kernel that predates this fix is potentially vulnerable.

The likely attack vector is a local kernel race condition that occurs when a TX worker runs during a netpoll shutdown. Based on the description, it is inferred that an attacker would need to cause the TX worker to execute while the system is shutting down, which is a non‑trivial scenario that would typically require privileged access or a compromised system. The CVSS score of 5.5 suggests moderate severity, and the EPSS score of < 1 % indicates a low probability of exploitation. The lack of inclusion in CISA’s KEV catalog further suggests that the vulnerability has not yet been actively exploited. Therefore, the overall risk is considered low to moderate, with the most probable outcome being a denial of service through kernel crash rather than immediate privilege escalation.