A flaw in the Linux kernel’s rhashtable implementation leaves the iterator pointer stale after a table restart; the iterator is later dereferenced, resulting in a use‑After‑Free that crashes the kernel. The fault originates during rhashtable_walk_start_check and is uncovered when subsequent walks access the freed memory. The crash is manifested as a KASAN error or kernel panic, disabling kernel functionality.

The vulnerability exists in all Linux kernel builds that use the rhashtable data structure and were released before the patch commit identified in the provided references. Distributions that ship unpatched kernels, such as older stable releases, are impacted. The flaw is triggered by components that perform multi‑fragment rhashtable walks across start/stop boundaries, including netlink diagnostics and TIPC socket walks.

The EPSS score is less than 1 % and the CVE is not listed in the CISA KEV catalog, indicating a low publicly observed exploitation probability. The CVSS score of 7.8 classifies it as high severity. Based on the description, it is inferred that the flaw requires local or privileged access to the affected kernel in order to trigger a rhashtable walk that encounters a freed object. While the primary impact is denial of service via kernel crash, the use‑After‑Free could be leveraged for privilege escalation if an attacker obtains sufficient control over the affected walk.