In the Linux kernel, the AF_PACKET TX_RING teardown logic can free a memory region that socket buffers still reference. The skb keeps a raw pointer to the ring frame but does not maintain a vmalloc mapping after pg_vec is released, resulting in a use‑after‑free scenario. This race can corrupt kernel memory and potentially allow privilege escalation or denial of service. The flaw is a classic memory corruption vulnerability, classified as CWE‑416.

Systems running Linux kernel versions that lack the commit that defers the vmalloc TX_RING free until the skbs complete are affected. The patch is incorporated in recent stable releases of the kernel, specifically in commits such as 0189dce07db2dc059ae0570e06758ec4233c6e11. Any host using older kernels or custom builds that omit this change remains vulnerable.

The CVSS score is not published in the advisory, but the nature of a use‑after‑free in kernel space is generally considered high to critical severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating no known mass exploitation. Exploitation would require an attacker to create a race on AF_PACKET sockets, which could be achieved locally or over the network if packet sockets are exposed. While there are no public exploits yet, the potential impact—kernel memory corruption leading to privilege escalation—makes it a high‑impact flaw.