The issue is a double free in the rtase_start_xmit() path of the Linux kernel. When a DMA mapping of the head buffer fails after all fragments have already been mapped, the error handling clears the fragment descriptors and frees the socket buffer (skb) once via the fragment slot, then falls through to a common error label that frees the same skb again. This double free corrupts kernel heap memory. The underlying weakness is a classic double‑free condition.

All Linux kernel builds that contain the rtase_start_xmit() routine without the upstream fix are affected. No specific version range is supplied in the advisory, so current kernel releases remain potentially vulnerable until the patch is applied. Distribution‑maintained kernel packages should be inspected for the inclusion of the upstream commit when deploying systems.

The flaw is triggered during normal packet transmission when a DMA mapping failure occurs. No public exploits are reported and the EPSS score of <1% suggests an indeterminate but non‑negligible exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, indicating no known exploitation in the wild. The CVSS score of 9.8 indicates a critical severity, and the low EPSS score reinforces the need for prompt remediation.