The kernel’s inet fragment queue routine starts a timeout timer before adding the queue to the lookup hash table. If the fragment timeout is zero or negative, the timer can expire while the queue is still hidden. The callback then attempts to remove a node that is not yet present, dropping a reference that is never restored. This race can leave a stale hash entry, corrupt kernel memory, and cause a crash, resulting in a denial of service. The flaw stems from a race condition and improper removal logic, as reflected in CWE-367.

All Linux kernel builds that include the inet fragment queue code are affected. No specific version range is listed, so the issue may exist in any kernel until the commit referenced in the advisory is merged.

Based on the description, it is inferred that delivering specially crafted fragmented IP traffic that triggers the faulty timer behavior is the likely attack vector, implying a network‑based attack vector. The EPSS score is less than 1%, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting low public exploitation activity. Nonetheless, the CVSS score of 9.8 indicates a critical severity, and the risk remains significant until a patch is applied.