The vulnerability is a use‑after‑free in the Linux kernel's staging nvec driver function nvec_rx_completed(). When an incomplete RX transfer is detected, the driver frees a message buffer but immediately accesses its first data byte. If another allocation has already reclaimed that buffer, the read accesses memory that may contain attacker‑controlled data, allowing memory corruption in the kernel. This flaw could lead to privilege escalation or code execution; the actual occurrence of these outcomes is inferred from the vulnerability's effect on kernel memory, not directly confirmed in the description.

All Linux kernel builds that include the staging nvec driver before the patch are affected. Systems running any unpatched kernel where the nvec module is loaded or autoloaded are potentially vulnerable; the issue is not tied to a specific kernel version.

The CVSS score of 8.4 indicates high severity, while the EPSS score of less than 1 % indicates a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the flaw permits arbitrary memory corruption in kernel space, which could lead to privilege escalation or code execution if an attacker can influence the nvec_rx_completed path, for example by sending crafted network traffic to the device. No public exploit is known, so the immediate risk is uncertain but potentially significant if a suitable exploit is developed.