This kernel bug arises from a race condition between the lockless check of the device state when queuing packets and the later flushing of the device backlog during unregistration. When a lockless transmitter passes a stale running check, the backlog may be flushed before the packet is enqueued, allowing the packet to escape the flush and later invoke a use‑after‑free in the packet handling path. This flaw can lead to arbitrary writes in kernel memory and therefore remote code execution in privileged context.

All Linux kernel builds that do not include the committed fix (move the netif_running() check inside the backlog lock). The vulnerability is present in kernels prior to the application of the commit referenced above and affects all distributions that ship those unpatched kernels.

The CVSS score of 9.9 classifies this vulnerability as critical. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. Nonetheless, the flaw involves a kernel use‑after‑free, a high‑severity condition. An attacker would require the ability to transmit malicious packets while a network namespace is being torn down or a device is being unregistered, which typically implies local or privileged access. The potential impact is remote code execution with root privileges. The lack of a public exploit does not diminish the severity of the flaw given its inherent kernel privilege escalation risk.