The kernel exposes a use‑after‑free condition in the VXLAN driver; when a VXLAN interface is brought down without a netif_running() check, the ageing timer is incorrectly armed and scheduled to run; the subsequent timer tick dereferences a freed struct, triggering KASAN and resulting in kernel memory corruption that can be leveraged for arbitrary code execution or privilege escalation by an attacker using user or network namespace operations.

All versions of the Linux kernel that support VXLAN are potentially affected, as the flaw resides in the generic vxlan_* driver code present in every kernel configuration that enables VXLAN support; the product is the Linux kernel itself, and no specific vendor or version is excluded.

The vulnerability thrives on local attack vectors where an unprivileged user can perform rtnl operations to create or delete VXLAN links within a network namespace; while an official CVSS score is unavailable, the use‑after‑free nature and potential for arbitrary code execution imply high severity; EPSS data is not provided and the issue is not catalogued in the CISA KEV catalog, yet administrators should consider it a critical risk until a patched kernel is deployed.