During concurrent operations of the UDP tunnel driver a worker can clear the pending flag for a running task and inadvertently clear the flag for a newly queued instance. When the second work item is still active, the unregister routine frees the structure, leaving the active work item pointing to freed memory. This use‑after‑free allows an attacker to trigger kernel memory corruption, potentially leading to arbitrary code execution or privilege escalation.

All Linux kernel versions containing the udp_tunnel driver prior to the 2026‑08‑15 patch are affected. The vulnerability is present in the mainline kernel and is therefore present in all distributions that ship that kernel without applying the fix.

The CVSS score for this vulnerability is 7.8, and the EPSS score is below 1 %. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to trigger concurrent UDP tunnel device operations, but successful exploitation could result in kernel mode code execution.