A use‑after‑free bug in the fbnic network driver’s packet transmission function leads to a memory corruption fault when an skb is reallocated. The vulnerability is triggered when the driver retains a stale pointer to shared information across an skb reallocation, causing a kernel crash when the memory is accessed after it has been freed. This flaw can potentially allow an attacker to read or modify kernel memory and to induce a kernel panic if the freed memory is reused.

All Linux kernel installations that include the fbnic Ethernet driver are impacted. The vendor is Linux, and the affected product is the Linux kernel. No specific version numbers are listed, so any kernel version that incorporates the unpatched fbnic driver is considered vulnerable.

The CVSS score of 9.8 indicates critical severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The bug was observed as a slab-use-after-free in the kernel, indicating that, if an attacker can send crafted packets through the fbnic interface, it could lead to kernel memory corruption or code execution. The attack likely requires network access to the machine and the ability to send malformed packets to the fbnic interface.