The Linux kernel contains a race condition between device teardown (inetdev_destroy) and IGMP query processing (igmp_rcv). When a network device is being torn down, its reference count can drop to zero while the memory is still being held for an RCU‑deferred free. Concurrently, an incoming IGMP query may trigger igmp_gq_start_timer, which attempts to hold a reference to the same device. Because the reference count is already zero, this action causes a use‑after‑free flaw, classified as CWE‑825, leading the timer callback to access freed memory and trigger a kernel panic. The resulting denial of service manifests as an unexpected reboot or crash, potentially causing data loss or disruption during recovery.

All Linux kernel implementations that have not applied the in_dev_hold_safe patch are affected. Any system running a kernel version prior to the patch is at risk, regardless of distribution, as the vulnerability exists in the core kernel source and is not limited to a specific release.

The CVSS score of 9.8 reflects critical severity. The EPSS score of < 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is crafted IGMP packets sent to an interface whose device is concurrently being destroyed, which is inferred from the race condition described. Successful exploitation requires sufficient network access to send the offending IGMP query and a timing window during device tear‑down, leading to a kernel panic and denial of service. Because the flaw deals with kernel memory, a local or remote attacker with packet‑sending privileges could trigger it, but the constraints reduce practical exploitation probability.