The issue is a double free in the rtase_start_xmit() path of the Linux kernel. When a DMA mapping of the head buffer fails after all fragments have already been mapped, the error handling clears the fragment descriptors and frees the socket buffer (skb) once via the fragment slot, then falls through to a common error label that frees the same skb again. This double free corrupts kernel heap memory and can be leveraged by a local attacker to crash the system or, if refined, to execute code at ring‑0. The underlying weakness is a classic double‑free condition (CWE‑415).

All Linux kernel builds that contain the rtase_start_xmit() routine without the upstream fix are affected. No specific version range is supplied in the advisory, so current kernel releases remain potentially vulnerable until the patch is applied. Distribution‑maintained kernel packages should be inspected for the inclusion of the upstream commit when deploying systems.

The flaw is triggered during normal packet transmission when a DMA mapping failure occurs, which an attacker with local privileges could induce to exercise the double‑free. No public exploits are reported and the EPSS score is not available, suggesting an indeterminate but non‑negligible exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, indicating no known exploitation in the wild. While the CVSS score is absent, the potential for kernel heap corruption warrants immediate attention.