The Linux kernel's vector_mmsg_rx() function contains a use‑after‑free flaw (CWE-763) that can be triggered when a received packet's overlay header fails verification. If the header check fails, the code frees the associated socket buffer but incorrectly continues the loop, leaving the freed buffer still referenced in the skbuff_vector array. The next loop iteration processes this freed skb again, causing a reference count underflow and a use‑after‑free in the RX path. An attacker who can craft a packet that makes verify_header() return a negative value—such as a GRE or L2TPv3 cookie or session‑id mismatch—can exploit this path. The flaw does not require authentication and can lead to kernel memory corruption, denial of service, or potential privilege escalation.

The bug affects all Linux kernel releases that have not yet incorporated the patch. It applies only when the GRE or L2TPv3 tunneling transports are enabled, which are common in VPN appliances and dynamic routing devices. No specific vendor or version ranges are listed, so any system running a vulnerable kernel with GRE or L2TPv3 enabled is at risk.

The CVSS score of 9.8 indicates a high severity. The EPSS score is reported as < 1%, indicating low exploitation probability under current conditions. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw can be triggered remotely over the network and is a kernel‑level use‑after‑free, an attacker could potentially achieve kernel memory corruption, leading to denial of service or privilege escalation. The likely attack vector is a network packet sent to a system with GRE or L2TPv3 enabled, with no authentication required.