The Linux kernel’s GTP module contains a race condition between the netlink deletion path for GTP_CMD_DELPDP and the network device removal path RTM_DELLINK. When the two operations run in parallel, they can both attempt to delete the same PDP context, and the second deletion may dereference a freed pointer, causing a use‑after‑free that leads to a kernel crash. This is a classic example of a use‑after‑free (CWE‑416) created by a race condition (CWE‑362), which can terminate processes or bring the system down entirely.

Any Linux kernel build that has not yet incorporated the fix that serializes gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a shared mutex and protects the entire PDP context use with RCU. The affected versions are all releases prior to the patch in the references; the exact kernel version ranges are not specified in the advisory.

The CVSS score for this defect is not listed, and no EPSS metric is available, so a quantitative risk assessment cannot be provided. The technical description indicates that an attacker must trigger both deletion paths concurrently, which typically requires privileged access to send the GTP_CMD_DELPDP netlink command or to initiate a network device removal. Based on the description, it is inferred that the attack vector is local or limited to users with CAP_NET_ADMIN. No public exploit has been reported, and the vulnerability is not included in the CISA KEV catalog. Consequently, exploitation is likely limited to targeted or opportunistic attacks rather than widespread automated attacks, though a successful crash would provide a complete denial of service to the affected device.