The flaw in the Linux kernel’s reception queue lease teardown inverts the order of stopping a physical queue and revoking its DMA memory provider. This can leave the queue’s NAPI running while DMA mappings are cleared, allowing devices that perform DMA to write to stale or zeroed memory. The result is a use‑after‑free scenario that could corrupt kernel memory and potentially enable privilege escalation to root. The weakness corresponds to CWE‑825.

The vulnerability affects the Linux kernel code base. Any system running a kernel that has not incorporated the net: Stop leased rxq before uninstalling its memory provider fix is susceptible. The affected component is the networking stack’s queue leasing logic, which is used by network firmware that leases RX queues for DMA. No specific vendor or product version list is supplied beyond the generic Linux kernel.

The CVSS score is 8.8, and the EPSS score is < 1%, indicating a high severity but a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The exploit would require a DMA‑capable device that can interact with the kernel’s queue lease API. In practice, an attacker with the ability to introduce or control such a device could trigger the race condition, leading to kernel memory corruption. In the absence of a publicly known exploit, the risk remains theoretical but significant for systems with exposed DMA devices.