The veth driver in the Linux kernel has a flaw that can cause a use‑after‑free of a napi_struct. When an XDP queue registration fails, the rollback loop incorrectly skips removing the NAPI handler that was previously added. The stray napi_struct remains in the device’s list and is later dereferenced during device teardown, corrupting kernel memory. This classic use‑after‑free weakness can lead to kernel crashes or privilege escalation if exploited.

All Linux kernel releases that include the veth driver with XDP support and have not yet incorporated the patch. The advisory does not specify exact version ranges, so any kernel prior to the commit referenced by the patch is potentially vulnerable.

The EPSS score is reported as < 1%, indicating a very low practical likelihood of exploitation, while the CVSS score is 7.8 and it is not listed in CISA KEV. The likely attack vector is a local privileged operation that requires the ability to create or modify veth interfaces and load XDP programs (CAP_NET_ADMIN or root). Exploitation would require the attacker to trigger the XDP enable path on a vulnerable device; if successful, it could lead to kernel memory corruption or privilege escalation, but the exploitation conditions and low EPSS suggest a low overall risk.