The vulnerability resides in the PPP over L2TP UDP encapsulation code path in the Linux kernel. An unprivileged user can trigger a use‑after‑free when an L2TP UDP socket that is bound to a PPP channel is closed while the channel is still being processed by the receiving routine. The freed channel memory may be accessed again, causing a crash or, if the attacker can influence the freed memory contents, possible arbitrary code execution. The flaw is a classic use‑after‑free defect and is observed via normal user‑level operations such as closing sockets, so it is reachable by any local user.

This defect affects the Linux kernel in all versions that implement the PPP over L2TP UDP encapsulation handler. No specific kernel sub‑versions are enumerated in the advisory, so any kernel compiled with that functionality is potentially vulnerable. The advisory lists the Linux kernel as the only affected product.

The CVSS score and EPSS score are not disclosed, and the vulnerability is not listed in CISA's KEV catalog, indicating that it is not yet publicly exploited. However, the defect is a use‑after‑free reachable through ordinary user actions, suggesting a moderate exploitation risk if an attacker can control the freed memory contents. Attackers would need local access and the ability to perform a race condition between the close operation and the in‑flight processing. Given the lack of public exploits and the need for a race, the overall likelihood of successful exploitation is currently considered low to moderate, but the impact is high if exploited.