A race condition occurs in the Linux kernel net/packet subsystem when the packet_set_ring function reallocates a socket’s ring. While the socket’s hook is temporarily detached, a NETDEV_UNREGISTER notifier can change the socket state and invalidate the device binding. When packet_set_ring later resumes, it may re‑register the hook using stale state, allowing the socket to bind to a device that has already been unregistered. This logic flaw can lead to loss of packet routing, effectively providing a denial‑of‑service to network services that rely on that socket.

The vulnerability affects all Linux kernel builds that include the unpatched packet_set_ring implementation referenced in the commit series. No specific kernel major/minor versions are listed in the data; the fix is aggregated across the Linux kernel code base.

Based on the description, it is inferred that the race condition could be triggered by a local actor with sufficient privileges to create sockets and initiate NETDEV_UNREGISTER. The CVSS score is 7.8 and the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Because the description does not specify a remote exploitation path, remote attackers are unlikely to gain direct access; the attack thus requires local privileged exploitation. If successfully triggered, the kernel may re‑register a fanout hook after the device has been unregistered, potentially leading to loss of packet routing and a denial‑of‑service or kernel instability. The absence of public exploit references suggests a moderate exploitation probability, but the impact on stability means the risk remains significant for systems that see untrusted network traffic.