The vulnerability occurs in the Linux kernel’s TIPC subsystem when a link pointer is cached without holding the node lock and later freed by another thread that also holds the lock. This race condition results in a use‑after‑free, where the freed memory is subsequently read and written, potentially corrupting kernel memory. If exploited, an attacker could trigger a kernel crash or, depending on surrounding code, arbitrary code execution. The flaw is a classic heap use‑after‑free and is therefore a high‑severity memory corruption issue.

All Linux kernel builds that contain the TIPC networking stack are potentially affected until the patch that moved the le->link read inside the write lock is applied. No specific version range is listed; the bug existed in at least the 7.2.0 RC kernel and earlier stable releases that have not yet incorporated the commit adding the lock guard.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of < 1% suggests low likelihood of exploitation at this time, though the vulnerability still carries the risk of kernel memory corruption if leveraged. The bug is not listed in CISA KEV and no public exploits are known. The likely attack vector requires a user who can influence TIPC traffic or invoke netlink bearer disable operations, such as a local attacker with network privileges or someone controlling TIPC traffic.