A use‑after‑free occurs in the Linux kernel PPPoE implementation when pppoe_sendmsg() saves a pointer to the PPPoE header and later calls dev_hard_header(). The header callback can reallocate the socket buffer head, invalidating the stored pointer. When PPPoE subsequently writes six bytes through the stale pointer into the freed head, memory corruption is introduced. This flaw is a classic use‑after‑free (CWE‑416) that can destabilize the kernel and cause a crash.

The defect resides in the Linux kernel networking stack; all releases older than the patch that restores the PPPoE header pointer after dev_hard_header() are affected. No specific kernel version is listed in the advisory, so any unpatched kernel is considered vulnerable.

The EPSS score is not available and the vulnerability is not cataloged in CISA KEV. Because the flaw involves a kernel memory corruption that leads to a crash, the theoretical severity is high, even though a CVSS score is not supplied. The likely attack vector requires the ability to send PPPoE packets through a team device that contains a non‑Ethernet port while a user‑space operation is blocked in copy_from_user(). Once those prerequisites are met, an attacker could trigger the use‑after‑free and cause a kernel panic or, if attacker‑controlled data is involved, potentially achieve arbitrary code execution. No publicly available exploit is referenced in the provided sources; the threat is considered hypothetical pending real‑world usage.